Compare commits

...

943 Commits

Author SHA1 Message Date
0d4cc06342 chore: new release 2025.1 2025-03-01 16:38:56 +01:00
1d74727db6 chore: new release 2025.0 2025-03-01 16:03:06 +01:00
957cd161f2 chore: bump org.wiremock:wiremock-standalone from 3.11.0 to 3.12.0 (#2026)
Bumps [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock) from 3.11.0 to 3.12.0.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.11.0...3.12.0)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock-standalone
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-01 11:01:46 +01:00
16b7a13de8 chore: add test case for multiple users solving lessons (#2043) 2025-02-28 20:56:15 +01:00
95dcc56a19 fix: register user while already logged in as other user. (#2042) 2025-02-28 20:56:00 +01:00
55bd0a49db chore: cleanup IT tests (#2040) 2025-02-28 18:39:23 +01:00
b5af30c819 chore: bump docker/build-push-action from 6.13.0 to 6.14.0 (#2033) 2025-02-27 18:35:10 +01:00
3d4780d7e0 chore: bump org.testcontainers:testcontainers from 1.20.4 to 1.20.5 (#2034) 2025-02-27 18:34:58 +01:00
92d4981b90 chore: bump com.diffplug.spotless:spotless-maven-plugin (#2035) 2025-02-27 18:34:47 +01:00
8166b10c1a chore: bump org.testcontainers:junit-jupiter from 1.20.4 to 1.20.5 (#2036) 2025-02-27 18:34:36 +01:00
6d1ebadf85 chore: bump org.springframework.boot:spring-boot-starter-parent (#2037) 2025-02-27 18:34:24 +01:00
9572a7b840 chore: bump com.microsoft.playwright:playwright from 1.49.0 to 1.50.0 (#2025) 2025-02-22 20:55:35 +01:00
6c16d4ccfc chore: bump io.github.bonigarcia:webdrivermanager from 5.9.2 to 5.9.3 (#2027) 2025-02-22 20:55:07 +01:00
93c3f19ca7 chore: bump org.jruby:jruby from 9.4.11.0 to 9.4.12.0 (#2028) 2025-02-22 20:54:55 +01:00
fadb07d73e chore: bump devops-infra/action-pull-request from 0.5.5 to 0.6.0 (#2029) 2025-02-22 20:54:44 +01:00
f66126e53d chore: bump devops-infra/action-commit-push from 0.9.2 to 0.10.0 (#2030) 2025-02-22 20:54:32 +01:00
c3c520f487 refactor: small updates and improvements in HTTP Basic lesson (#2024)
* refactor: cleanup attack result and builder

* refactor: solve compiler warnings

* feature: improve HTTP basics lesson

Closes: #494
2025-02-18 14:26:21 +01:00
00f3538be2 chore: format all code according to SPDX (#2023) 2025-02-16 19:48:05 +01:00
2a5b4385ea chore: bump com.diffplug.spotless:spotless-maven-plugin (#2006)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 2.41.1 to 2.44.2.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/maven/2.41.1...maven/2.44.2)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 19:52:40 +01:00
79ac5b7b99 chore: bump docker/build-push-action from 6.12.0 to 6.13.0 (#2012)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.12.0 to 6.13.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.12.0...v6.13.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 18:55:37 +01:00
8638d94595 chore: bump org.springframework.boot:spring-boot-starter-parent (#2013)
Bumps [org.springframework.boot:spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) from 3.4.1 to 3.4.2.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](https://github.com/spring-projects/spring-boot/compare/v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 18:55:26 +01:00
3ef5e34dd0 chore: bump org.jruby:jruby from 9.4.9.0 to 9.4.11.0 (#2017)
Bumps org.jruby:jruby from 9.4.9.0 to 9.4.11.0.

---
updated-dependencies:
- dependency-name: org.jruby:jruby
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 18:55:09 +01:00
019ab0495f chore: bump com.auth0:java-jwt from 4.4.0 to 4.5.0 (#2018)
Bumps [com.auth0:java-jwt](https://github.com/auth0/java-jwt) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/auth0/java-jwt/releases)
- [Changelog](https://github.com/auth0/java-jwt/blob/master/CHANGELOG.md)
- [Commits](https://github.com/auth0/java-jwt/compare/4.4.0...4.5.0)

---
updated-dependencies:
- dependency-name: com.auth0:java-jwt
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 18:54:59 +01:00
2aeee521ab chore: bump org.wiremock:wiremock-standalone from 3.10.0 to 3.11.0 (#2019)
Bumps [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock) from 3.10.0 to 3.11.0.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.10.0...3.11.0)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock-standalone
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 18:54:49 +01:00
b940e5ce58 chore: bump docker/setup-qemu-action from 3.3.0 to 3.4.0 (#2022)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 3.3.0 to 3.4.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v3.3.0...v3.4.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-15 18:54:38 +01:00
9c90a24cc0 docs(CSRFFeedback.java): fixed one invalid solution about CSRF attack (#2010)
Co-authored-by: HackHuang <GoogTech@outlook.com>
Co-authored-by: HackHuang <hi@goog.tech>
2025-01-26 20:23:40 +01:00
2ac50bfbd8 chore: bump docker/build-push-action from 6.11.0 to 6.12.0 (#2005)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.11.0 to 6.12.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.11.0...v6.12.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-26 19:18:25 +01:00
d96dbe2edf fix: build failure 2025-01-26 18:47:10 +01:00
8e45316638 feat: Introduce Playwright for UI testing
Instead of using Robot Framework which does not run during a `mvn install`. Playwright seems to be the better approach. We can now write them as normal JUnit test and they are executed during a build.

Additionally this PR solves some interesting bugs found during writing Playwright tests:

- A reset of a lesson removes all assignments as a result another user wouldn't see any assignments
- If someone solves an assignment the assignment automatically got solved for a new user since the assignment included the `solved` flag which immediately got copied to new lesson progress.
- Introduction of assignment progress linking a assignment not directly to all users.
2025-01-26 16:59:59 +01:00
9d5ab5fb21 chore: bump docker/setup-qemu-action from 3.1.0 to 3.3.0 (#2000) 2025-01-14 23:33:20 +01:00
aee7abc6b7 chore: bump docker/build-push-action from 6.10.0 to 6.11.0 (#2001) 2025-01-14 23:32:04 +01:00
06e2fdbd33 refactor: use symbolic link for Java (#1996) 2025-01-12 16:17:45 +01:00
02f43c54d0 chore: bump org.springframework.boot:spring-boot-starter-parent (#1994) 2024-12-25 11:00:53 +01:00
19f4f8dc46 chore: bump com.google.guava:guava from 33.3.1-jre to 33.4.0-jre (#1995) 2024-12-25 11:00:37 +01:00
112ca3ab22 fix: enable resource patterns again (#1993)
`LessonScanner.java` got removed by mistake.

Closes: gh-1992
2024-12-21 18:47:30 +01:00
0244655409 feat: Move to Java 23
Closes: gh-1990
2024-12-21 14:16:33 +01:00
a95213757d chore: bump org.springframework.boot:spring-boot-starter-parent from 3.3.5 to 3.4.0 (#1962) 2024-12-16 20:16:10 +01:00
6d90852c1f chore: bump org.apache.commons:commons-text from 1.12.0 to 1.13.0 (#1986) 2024-12-16 20:15:53 +01:00
4f8652758c refactor: remove unused code (#1985) 2024-12-15 13:06:49 +01:00
5fc2e0602c refactor: move plugin messages (#1968) 2024-12-03 22:13:44 +01:00
f3c7f4588b chore: bump docker/build-push-action from 6.9.0 to 6.10.0 (#1969) 2024-12-03 22:13:24 +01:00
119b84d034 chore: bump org.wiremock:wiremock-standalone from 3.9.2 to 3.10.0 (#1970) 2024-12-03 22:13:11 +01:00
afd951228d chore: bump org.jsoup:jsoup from 1.18.1 to 1.18.3 (#1971) 2024-12-03 22:13:00 +01:00
51e3f59054 fix: Hint labels showing default text regardless of localization (#1965) 2024-11-26 23:34:09 +01:00
cc0efd8600 chore: bump commons-io:commons-io from 2.17.0 to 2.18.0 (#1961) 2024-11-26 23:21:10 +01:00
e29dccf3c9 chore: bump org.testcontainers:junit-jupiter from 1.20.3 to 1.20.4 (#1963) 2024-11-26 23:20:25 +01:00
0cf861fb3c chore: bump org.testcontainers:testcontainers from 1.20.3 to 1.20.4 (#1964) 2024-11-26 23:20:11 +01:00
d8100385b6 fix: automatically solve XSS mitigation (#1957)
This PR moves the mitigation Java class into the correct package.

The lesson was automatically solved because no assignments were found.

Closes: #1943
2024-11-14 08:42:55 +01:00
4880afa0e3 fix: remove implicit context path guessing (#1956)
Pass the context-path in the assignment overview so the frontend can easily match an assignment.
2024-11-13 21:32:28 +01:00
e60ca6ce72 chore: bump org.jruby:jruby from 9.4.8.0 to 9.4.9.0 (#1954) 2024-11-11 13:46:45 +01:00
88a763f513 chore: bump org.testcontainers:junit-jupiter from 1.20.1 to 1.20.3 (#1946)
Bumps [org.testcontainers:junit-jupiter](https://github.com/testcontainers/testcontainers-java) from 1.20.1 to 1.20.3.
- [Release notes](https://github.com/testcontainers/testcontainers-java/releases)
- [Changelog](https://github.com/testcontainers/testcontainers-java/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testcontainers/testcontainers-java/compare/1.20.1...1.20.3)

---
updated-dependencies:
- dependency-name: org.testcontainers:junit-jupiter
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-07 16:13:27 +01:00
7f33d3609f chore: bump org.apache.maven.plugins:maven-surefire-plugin (#1948)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.5.1 to 3.5.2.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.5.1...surefire-3.5.2)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-07 16:13:10 +01:00
bf02077427 chore: bump org.wiremock:wiremock-standalone from 3.9.1 to 3.9.2 (#1947)
Bumps [org.wiremock:wiremock-standalone](https://github.com/wiremock/wiremock) from 3.9.1 to 3.9.2.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.9.1...3.9.2)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock-standalone
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-07 15:46:43 +01:00
e1e00bca73 fix: JWT kid/jku lessons (#1949)
* refactor: rewrite hints

Use active voice and fix grammar issues.

* fix: use Thymeleaf `th:action`

* fix: JWT kid/jku lessons

Split the JavaScript into two files they pointed to the same URL

The JWTs are now valid, they parse successfully.

The paths now include `/kid` and `/jku` to make sure the hints match accordingly in the UI. Otherwise `/delete` would pick up both hints from both assignments as the paths overlap.

Closes: #1715

* fix: update to latest pre-commit version

* fix: increase timeouts for server to start during integration tests
2024-11-07 15:45:33 +01:00
d59153d6d7 Fix password reset lesson (#1941)
* docs: improve text

* fix: use correct POST url
2024-10-29 17:32:51 +01:00
87fae00f03 chore: bump commons-io:commons-io from 2.16.1 to 2.17.0 (#1937)
Bumps commons-io:commons-io from 2.16.1 to 2.17.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-29 16:30:32 +01:00
3f6a74ad86 chore(gh-actions): update dependency 2024-10-28 22:02:02 +01:00
1d37ee0877 ci: run pre-commit checks first
Create a dependency between the jobs.
2024-10-28 21:59:10 +01:00
4f6ab25ebd ci: run pre-commit checks first 2024-10-28 21:57:43 +01:00
af687e71fe chore: bump com.google.guava:guava from 33.3.0-jre to 33.3.1-jre (#1939) 2024-10-28 20:02:09 +01:00
83ed4c3d5c chore: bump org.testcontainers:testcontainers from 1.20.1 to 1.20.3 (#1935) 2024-10-28 15:05:33 +01:00
62cdfd0824 chore: bump com.github.terma:javaniotcpproxy from 1.5 to 1.6 (#1936) 2024-10-28 15:04:15 +01:00
e7457f4821 chore: bump org.apache.maven.plugins:maven-checkstyle-plugin (#1938) 2024-10-28 15:04:01 +01:00
4efaf87c7e Fix passing command line arguments (#1933)
* fix: use banners correctly

* fix: passing command line arguments

Since we already have `webwolf.port` it makes sense to also define `webwolf.port` explicitly and not rely on `server.port`

Closes: #1910
2024-10-27 08:39:02 +01:00
cf5101a633 chore: bump org.asciidoctor:asciidoctorj from 2.5.13 to 3.0.0 (#1897) 2024-10-26 22:53:43 +02:00
3f049ba53a Nbaars/1886 (#1932)
* improved code readbility

* chore: format code

---------

Co-authored-by: guilherme peixoto <peixoto-guilherme7@hotmail.com>
2024-10-26 22:18:28 +02:00
7e294fbdb5 chore: bump org.apache.commons:commons-compress from 1.26.2 to 1.27.1 (#1884) 2024-10-26 19:27:07 +02:00
2177eb663a chore: bump docker/build-push-action from 6.7.0 to 6.9.0 (#1920) 2024-10-26 16:59:13 +02:00
50692300eb docs: Show boolean operators priority on where (#1902) 2024-10-26 14:48:50 +02:00
e2c2d425cb chore: bump actions/cache from 4.0.2 to 4.1.1 (#1925) 2024-10-26 14:25:04 +02:00
6bbd3cb66b chore: bump org.springframework.boot:spring-boot-starter-parent (#1931) 2024-10-26 14:20:14 +02:00
d08a56d351 chore: add test for solving same lesson as different user. (#1930)
We removed the constraint but did not add an extra testcase to cover this bug.

Closes: #1890
2024-10-26 12:06:30 +02:00
ec97568ec2 chore: bump org.apache.maven.plugins:maven-surefire-plugin (#1922)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.3.1 to 3.5.1.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.3.1...surefire-3.5.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-26 10:55:02 +02:00
9b68368b23 chore: bump pre-commit-ci/lite-action from 1.0.1 to 1.1.0 (#1926)
Bumps [pre-commit-ci/lite-action](https://github.com/pre-commit-ci/lite-action) from 1.0.1 to 1.1.0.
- [Release notes](https://github.com/pre-commit-ci/lite-action/releases)
- [Commits](https://github.com/pre-commit-ci/lite-action/compare/v1.0.1...v1.1.0)

---
updated-dependencies:
- dependency-name: pre-commit-ci/lite-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-26 10:54:46 +02:00
ab068901f1 Remove WebGoat session object (#1929)
* refactor: modernize code

* refactor: move to Tomcat

* chore: bump to Spring Boot 3.3.3

* refactor: use Testcontainers to run integration tests

* refactor: lesson/assignment progress

* chore: format code

* refactor: first step into removing base class for assignment

Always been a bit of an ugly construction, as none of the dependencies are clear. The constructors are hidden due to autowiring the base class. This PR removes two of the fields.

As a bonus we now wire the authentication principal directly in the controllers.

* refactor: use authentication principal directly.

* refactor: pass lesson to the endpoints

No more need to get the current lesson set in a session. The lesson is now passed to the endpoints.

* fix: Testcontainers cannot run on Windows host in Github actions.

Since we have Windows specific paths let's run it standalone for now. We need to run these tests on Docker as well (for now disabled)
2024-10-26 10:54:21 +02:00
cb7c508046 fix: reset form and quiz color on reset lesson (#1903)
* ./mvnw spotless:apply

```
[INFO] --- spotless-maven-plugin:2.41.1:apply (default-cli) @ webgoat ---
[INFO] Writing clean file: /home/ulyssa/labs/WebGoat/WebGoat-bb6e84d/src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson5a.java
```

* On reset lesson: reset form and quizzes colors
2024-10-26 09:22:18 +02:00
f4c86be6c7 Update fix version 2024-10-18 22:50:19 +02:00
cf2c115093 fix: xss lesson typo 2024-10-18 22:38:32 +02:00
bb6e84ddcf chore: bump com.google.guava:guava from 33.2.1-jre to 33.3.0-jre (#1879)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 33.2.1-jre to 33.3.0-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-04 21:44:38 +02:00
5fc2666b43 chore: bump docker/build-push-action from 6.5.0 to 6.7.0 (#1877)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.5.0 to 6.7.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.5.0...v6.7.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-04 21:43:46 +02:00
6e946f21a2 chore: bump io.github.bonigarcia:webdrivermanager from 5.9.1 to 5.9.2 (#1866)
Bumps [io.github.bonigarcia:webdrivermanager](https://github.com/bonigarcia/webdrivermanager) from 5.9.1 to 5.9.2.
- [Release notes](https://github.com/bonigarcia/webdrivermanager/releases)
- [Changelog](https://github.com/bonigarcia/webdrivermanager/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bonigarcia/webdrivermanager/compare/webdrivermanager-5.9.1...webdrivermanager-5.9.2)

---
updated-dependencies:
- dependency-name: io.github.bonigarcia:webdrivermanager
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-04 15:57:57 +02:00
d38ba2a626 chore: bump docker/build-push-action from 6.4.1 to 6.5.0 (#1867)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.4.1 to 6.5.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.4.1...v6.5.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-04 15:56:33 +02:00
4c7e6ae4f4 chore: bump org.wiremock:wiremock from 3.9.0 to 3.9.1 (#1865)
Bumps [org.wiremock:wiremock](https://github.com/wiremock/wiremock) from 3.9.0 to 3.9.1.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.9.0...3.9.1)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-04 15:56:12 +02:00
58b762eade fix: copying file using transferTo sometimes fails. (#1862)
Turns out that using this method sometimes fails with an exception about unable to delete a directory.
The stacktrace points to:

```
java.nio.file.FileSystemException: /tmp/webwolf-fileserver/dumbanddummer/xxe_a11.dtd: Not a directory
        at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:100) ~[na:na]
        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106) ~[na:na]
        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111) ~[na:na]
        at java.base/sun.nio.fs.UnixFileSystemProvider.implDelete(UnixFileSystemProvider.java:248) ~[na:na]
        at java.base/sun.nio.fs.AbstractFileSystemProvider.deleteIfExists(AbstractFileSystemProvider.java:110) ~[na:na]
        at java.base/java.nio.file.Files.deleteIfExists(Files.java:1191) ~[na:na]
        at java.base/java.nio.file.Files.copy(Files.java:3147) ~[na:na]
        at io.undertow.server.handlers.form.FormData$FileItem.write(FormData.java:274) ~[undertow-core-2.3.10.Final.jar!/:2.3.10.Final]
        at io.undertow.servlet.spec.PartImpl.write(PartImpl.java:119) ~[undertow-servlet-2.3.10.Final.jar!/:2.3.10.Final]
        at org.springframework.web.multipart.support.StandardMultipartHttpServletRequest$StandardMultipartFile.transferTo(StandardMultipartHttpServletRequest.java:254) ~[spring-web-6.0.13.jar!/:6.0.13]
        at org.owasp.webgoat.webwolf.FileServer.importFile(FileServer.java:89)
```

It has to do with the underlying implmentation in Undertow. An explaination can be found here: https://stackoverflow.com/questions/60336929/java-nio-file-nosuchfileexception-when-file-transferto-is-called

The solution is to take the input stream and use a simple `Files.copy()` to copy the file.

Closes: #1737
2024-07-28 17:47:30 +02:00
2b0c22ac68 Small improvements (#1848)
* refactor: remove CORS

* improvement: add healthcheck to Docker file
2024-07-23 17:42:56 +02:00
85103bbcad chore: bump docker/login-action from 3.2.0 to 3.3.0 (#1855)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3.2.0...v3.3.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-23 17:36:27 +02:00
b98e1a98e1 chore: bump docker/build-push-action from 6.2.0 to 6.4.1 (#1854)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.2.0 to 6.4.1.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.2.0...v6.4.1)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 20:33:06 +02:00
73de259809 chore: bump org.wiremock:wiremock from 3.8.0 to 3.9.0 (#1852)
Bumps [org.wiremock:wiremock](https://github.com/wiremock/wiremock) from 3.8.0 to 3.9.0.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.8.0...3.9.0)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 20:32:48 +02:00
4a804fabb6 chore: bump org.jsoup:jsoup from 1.17.2 to 1.18.1 (#1851)
Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.17.2 to 1.18.1.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.17.2...jsoup-1.18.1)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 20:32:27 +02:00
7f652dadec chore: bump org.apache.maven.plugins:maven-surefire-plugin (#1850)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.3.0 to 3.3.1.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.3.0...surefire-3.3.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 20:32:10 +02:00
f66dff1aeb chore: bump org.eclipse.jetty.ee10:jetty-ee10-bom (#1840)
Bumps [org.eclipse.jetty.ee10:jetty-ee10-bom](https://github.com/jetty/jetty.project) from 12.0.10 to 12.0.11.
- [Release notes](https://github.com/jetty/jetty.project/releases)
- [Commits](https://github.com/jetty/jetty.project/compare/jetty-12.0.10...jetty-12.0.11)

---
updated-dependencies:
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-bom
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-10 12:14:45 +02:00
777cec5a57 chore: bump io.github.bonigarcia:webdrivermanager from 5.8.0 to 5.9.1 (#1838)
Bumps [io.github.bonigarcia:webdrivermanager](https://github.com/bonigarcia/webdrivermanager) from 5.8.0 to 5.9.1.
- [Release notes](https://github.com/bonigarcia/webdrivermanager/releases)
- [Changelog](https://github.com/bonigarcia/webdrivermanager/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bonigarcia/webdrivermanager/compare/webdrivermanager-5.8.0...webdrivermanager-5.9.1)

---
updated-dependencies:
- dependency-name: io.github.bonigarcia:webdrivermanager
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 20:53:00 +02:00
98fd280459 chore: bump org.wiremock:wiremock from 3.7.0 to 3.8.0 (#1837)
Bumps [org.wiremock:wiremock](https://github.com/wiremock/wiremock) from 3.7.0 to 3.8.0.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.7.0...3.8.0)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 20:52:49 +02:00
8e0addff0b chore: bump org.jruby:jruby from 9.4.7.0 to 9.4.8.0 (#1841)
Bumps org.jruby:jruby from 9.4.7.0 to 9.4.8.0.

---
updated-dependencies:
- dependency-name: org.jruby:jruby
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 20:52:41 +02:00
a30fbc223a chore: bump docker/setup-qemu-action from 2.2.0 to 3.1.0 (#1842)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2.2.0 to 3.1.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2.2.0...v3.1.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 20:52:27 +02:00
a0b6decf34 Fix report card (#1845)
* fix: report card

Fix and simplify calculation of the number of assignments a user solved.
Rename `UserTracker` to `UserProgress`
Rename `LessonTracker` to `LessonProgress`
Rename tables in database
2024-07-09 20:07:09 +02:00
1531987da5 chore: bump docker/build-push-action from 6.1.0 to 6.2.0 (#1839)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6.1.0 to 6.2.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v6.1.0...v6.2.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-07 12:24:25 +02:00
bec6580c84 chore: bump docker/build-push-action from 5.4.0 to 6.1.0 (#1832)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.4.0 to 6.1.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v5.4.0...v6.1.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-29 10:16:10 +02:00
900702481b chore: bump org.wiremock:wiremock from 3.6.0 to 3.7.0 (#1834)
Bumps [org.wiremock:wiremock](https://github.com/wiremock/wiremock) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.6.0...3.7.0)

---
updated-dependencies:
- dependency-name: org.wiremock:wiremock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-26 09:14:21 +02:00
f35b23970e chore: bump org.apache.maven.plugins:maven-surefire-plugin (#1828)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.2.1 to 3.3.0.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.2.1...surefire-3.3.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-18 11:44:31 +02:00
074fd8f5ff chore: bump org.webjars:webjars-locator-core from 0.58 to 0.59 (#1827)
Bumps [org.webjars:webjars-locator-core](https://github.com/webjars/webjars-locator-core) from 0.58 to 0.59.
- [Commits](https://github.com/webjars/webjars-locator-core/compare/webjars-locator-core-0.58...webjars-locator-core-0.59)

---
updated-dependencies:
- dependency-name: org.webjars:webjars-locator-core
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-18 11:32:57 +02:00
8c890b090c chore: bump io.github.bonigarcia:webdrivermanager from 5.6.3 to 5.8.0 (#1826)
Bumps [io.github.bonigarcia:webdrivermanager](https://github.com/bonigarcia/webdrivermanager) from 5.6.3 to 5.8.0.
- [Release notes](https://github.com/bonigarcia/webdrivermanager/releases)
- [Changelog](https://github.com/bonigarcia/webdrivermanager/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bonigarcia/webdrivermanager/compare/webdrivermanager-5.6.3...webdrivermanager-5.8.0)

---
updated-dependencies:
- dependency-name: io.github.bonigarcia:webdrivermanager
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-18 10:38:31 +02:00
630c1e1afd chore: bump org.ow2.asm:asm from 9.5 to 9.7 (#1829)
Bumps org.ow2.asm:asm from 9.5 to 9.7.

---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-18 09:11:59 +02:00
061c75a05f chore: bump org.apache.commons:commons-compress from 1.26.0 to 1.26.2 (#1825)
Bumps org.apache.commons:commons-compress from 1.26.0 to 1.26.2.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-compress
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-18 08:28:49 +02:00
5e5a1363b0 chore: bump docker/build-push-action from 5.3.0 to 5.4.0 (#1824)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v5.3.0...v5.4.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-18 08:20:27 +02:00
47df923c8c chore: bump org.apache.maven.plugins:maven-enforcer-plugin (#1823)
Bumps [org.apache.maven.plugins:maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.3.0 to 3.5.0.
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.3.0...enforcer-3.5.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-16 08:20:29 +02:00
5dbc642264 chore: bump com.nulab-inc:zxcvbn from 1.8.0 to 1.9.0 (#1822)
Bumps [com.nulab-inc:zxcvbn](https://github.com/nulab/zxcvbn4j) from 1.8.0 to 1.9.0.
- [Release notes](https://github.com/nulab/zxcvbn4j/releases)
- [Changelog](https://github.com/nulab/zxcvbn4j/blob/main/CHANGELOG.md)
- [Commits](https://github.com/nulab/zxcvbn4j/compare/1.8.0...1.9.0)

---
updated-dependencies:
- dependency-name: com.nulab-inc:zxcvbn
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-16 08:14:48 +02:00
96bc6fa608 chore: bump org.apache.maven.plugins:maven-checkstyle-plugin (#1821)
Bumps [org.apache.maven.plugins:maven-checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) from 3.3.1 to 3.4.0.
- [Commits](https://github.com/apache/maven-checkstyle-plugin/compare/maven-checkstyle-plugin-3.3.1...maven-checkstyle-plugin-3.4.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-checkstyle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-16 08:09:49 +02:00
1d5a2bb6a2 chore: bump org.eclipse.jetty.ee10:jetty-ee10-bom from 12.0.3 to 12.0.10 (#1820)
Bumps [org.eclipse.jetty.ee10:jetty-ee10-bom](https://github.com/jetty/jetty.project) from 12.0.3 to 12.0.10.
- [Release notes](https://github.com/jetty/jetty.project/releases)
- [Commits](https://github.com/jetty/jetty.project/compare/jetty-12.0.3...jetty-12.0.10)

---
updated-dependencies:
- dependency-name: org.eclipse.jetty.ee10:jetty-ee10-bom
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-16 07:55:02 +02:00
8b37bd58d7 chore: bump commons-io:commons-io from 2.15.1 to 2.16.1 (#1819)
Bumps commons-io:commons-io from 2.15.1 to 2.16.1.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-14 17:41:45 +02:00
6545e2a066 chore: bump com.github.tomakehurst:wiremock (#1810)
Bumps [com.github.tomakehurst:wiremock](https://github.com/wiremock/wiremock) from 3.0.0-beta-2 to 3.0.0-beta-10.
- [Release notes](https://github.com/wiremock/wiremock/releases)
- [Commits](https://github.com/wiremock/wiremock/compare/3.0.0-beta-2...3.0.0-beta-10)

---
updated-dependencies:
- dependency-name: com.github.tomakehurst:wiremock
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-08 21:15:53 +02:00
9573b30667 chore: bump org.asciidoctor:asciidoctorj from 2.5.10 to 2.5.13 (#1811)
Bumps [org.asciidoctor:asciidoctorj](https://github.com/asciidoctor/asciidoctorj) from 2.5.10 to 2.5.13.
- [Release notes](https://github.com/asciidoctor/asciidoctorj/releases)
- [Changelog](https://github.com/asciidoctor/asciidoctorj/blob/v2.5.13/CHANGELOG.adoc)
- [Commits](https://github.com/asciidoctor/asciidoctorj/compare/v2.5.10...v2.5.13)

---
updated-dependencies:
- dependency-name: org.asciidoctor:asciidoctorj
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-08 21:09:45 +02:00
30e40f2e59 chore: bump org.jruby:jruby from 9.4.3.0 to 9.4.7.0 (#1813)
Bumps org.jruby:jruby from 9.4.3.0 to 9.4.7.0.

---
updated-dependencies:
- dependency-name: org.jruby:jruby
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-08 08:23:28 +02:00
8f11fb6729 chore: bump docker/login-action from 3.0.0 to 3.2.0 (#1815)
Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v3.0.0...v3.2.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-08 08:17:41 +02:00
10e36c203f chore: bump com.google.guava:guava from 32.1.3-jre to 33.2.1-jre (#1814)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 32.1.3-jre to 33.2.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-08 08:13:01 +02:00
edcce09b5f chore: bump docker/build-push-action from 5.1.0 to 5.3.0 (#1816)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5.1.0 to 5.3.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v5.1.0...v5.3.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-08 08:08:14 +02:00
3134f18066 fix: Success if only Smith earn most salary (#1744)
* Update labels

* Update Java

* Update Test

---------

Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-01 10:50:38 +02:00
e219887f14 docs: Update HttpBasics_plan.adoc - fix broken link to https://www.zaproxy.org/ (#1803)
fix broken link OWASP ZAP -  https://www.zaproxy.org/

Co-authored-by: René Zubcevic <rene@zubcevic.com>
2024-06-01 10:45:12 +02:00
508703ffce update dependencies and version (#1807)
* update dependencies and version
* debug macos build issue
* update and fix Dockerfile(s)
2024-05-31 19:39:03 +02:00
e308d7cde7 chore: upgrade checkout out to v4 (#1781) 2024-03-25 22:27:56 +01:00
4ab820e1d1 feat: move CSRF to A3 (#1776)
CSRF is part of security misconfiguration in the OWASP Top 10.
2024-03-21 20:50:37 +01:00
1a6a7e0be1 reverting my goofs after launching from wrong browser tab (#1774) 2024-03-19 18:01:30 +01:00
2e9140ab64 Merge pull request #1773 from misfir3/test-semgrep-on-merge
Test semgrep on merge
2024-03-18 13:21:21 -06:00
b79c83a52e linty 2024-03-18 19:19:12 +00:00
297c6f49b5 Merge branch 'main' into test-semgrep-on-merge 2024-03-18 13:14:39 -06:00
d2049a8fcc updating for testing 2024-03-18 19:13:50 +00:00
24db39eae2 test semgrep 2024-03-18 19:12:13 +00:00
98443184e9 Merge pull request #1 from WebGoat/develop
updating from main branch to test semgrep
2024-03-18 13:05:23 -06:00
62931a1836 feature: enable CORS configuration (#1771) 2024-03-17 10:55:27 +01:00
c18430752a build(Dockerfile): replace deprecated MAINTAINER tag with label of the same
Current syntax now used to denote the "WebGoat team" as maintainer

Link: https://docs.docker.com/reference/dockerfile/#label

Signed-off-by: cap-dev0x <158111888+cap-dev0x@users.noreply.github.com>
2024-02-25 23:20:23 +01:00
57d5b313b9 Fix typo in SQLi blind case 2024-02-10 16:02:35 +01:00
dd0f135088 fix(quiz): use $ instead of jQuery which is undefined (#1736)
Fixes: #1703

Signed-off-by: cap-dev0x <158111888+cap-dev0x@users.noreply.github.com>
2024-02-05 14:30:01 +01:00
ad0286d5ba chore: bump actions/cache from 3.3.1 to 4.0.0 (#1729)
Bumps [actions/cache](https://github.com/actions/cache) from 3.3.1 to 4.0.0.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.3.1...v4.0.0)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-29 11:03:15 +01:00
b67eb44142 chore: bump io.github.bonigarcia:webdrivermanager from 5.3.3 to 5.6.3 (#1716)
Bumps [io.github.bonigarcia:webdrivermanager](https://github.com/bonigarcia/webdrivermanager) from 5.3.3 to 5.6.3.
- [Release notes](https://github.com/bonigarcia/webdrivermanager/releases)
- [Changelog](https://github.com/bonigarcia/webdrivermanager/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bonigarcia/webdrivermanager/compare/webdrivermanager-5.3.3...webdrivermanager-5.6.3)

---
updated-dependencies:
- dependency-name: io.github.bonigarcia:webdrivermanager
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-09 15:10:16 +01:00
7e75e9b8fc chore: bump org.apache.commons:commons-exec from 1.3 to 1.4.0 (#1721)
Bumps org.apache.commons:commons-exec from 1.3 to 1.4.0.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-exec
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-09 14:59:40 +01:00
40c679ec5a chore: bump org.jsoup:jsoup from 1.16.1 to 1.17.2 (#1717)
Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.16.1 to 1.17.2.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md)
- [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.16.1...jsoup-1.17.2)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-09 14:51:32 +01:00
4ebb869f5d Fix hidden links in MissingFunctionAC.html. (#1710) 2023-12-29 15:01:35 +01:00
6bb7a182dc Fix typos in texts. 2023-12-14 23:00:59 +01:00
cb2c99d38d Improve texts to avoid confusion. 2023-12-14 22:54:20 +01:00
84029345b4 chore: bump actions/setup-java from 3 to 4 (#1698)
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 3 to 4.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-06 20:17:13 +01:00
a0ca199cdc chore: bump actions/setup-python from 4 to 5
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](https://github.com/actions/setup-python/compare/v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-06 19:39:28 +01:00
2058298e2d chore: move to SNAPSHOT 2023-12-06 17:35:12 +01:00
17acef57b4 chore: add pre-commit hooks
chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks

chore: add pre-commit hooks
2023-12-06 17:16:24 +01:00
d913967ec5 refactor: remove usage of RequestMapping 2023-12-06 17:16:24 +01:00
87edc7d1db refactor: use AssertJ for testing
Majority of our test cases use AssertJ
2023-12-06 17:16:24 +01:00
ac7a9c7863 chore: update GitHub action name 2023-12-05 14:22:19 +01:00
2803ef45e4 chore: bump org.webjars:bootstrap from 5.3.1 to 5.3.2 (#1693)
Bumps [org.webjars:bootstrap](https://github.com/webjars/bootstrap) from 5.3.1 to 5.3.2.
- [Commits](https://github.com/webjars/bootstrap/compare/bootstrap-5.3.1...bootstrap-5.3.2)

---
updated-dependencies:
- dependency-name: org.webjars:bootstrap
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-05 14:04:09 +01:00
5357a65e05 chore: release 2023.8 2023-12-05 11:21:15 +01:00
d343c60781 chore: do not spend time on building the Docker image
We can test this ourselves there is no need to run this on every PR towards the repository.
2023-12-05 11:15:53 +01:00
98acc1f55a fix: get the right Github token 2023-12-05 11:15:06 +01:00
f99888e61b fix: typo in the step of the name 2023-12-05 11:14:51 +01:00
29dda49190 chore: WebWolf bootstrap can now be updated 2023-12-05 11:14:27 +01:00
369be6f688 fix: disable extra build file 2023-12-05 11:14:08 +01:00
d5f869c006 chore: release version 2023.7 2023-12-04 23:10:52 +01:00
a9caaabb47 fix: wrong Docker image 2023-12-04 23:09:51 +01:00
fb2ff01775 chore: release 2023.6 2023-12-04 22:56:58 +01:00
89ecf1d2ad chore: bump actions/first-interaction from 1.2.0 to 1.3.0 (#1691)
Bumps [actions/first-interaction](https://github.com/actions/first-interaction) from 1.2.0 to 1.3.0.
- [Release notes](https://github.com/actions/first-interaction/releases)
- [Commits](https://github.com/actions/first-interaction/compare/v1.2.0...v1.3.0)

---
updated-dependencies:
- dependency-name: actions/first-interaction
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-04 22:45:16 +01:00
1b66a742da chore: bump actions/setup-java from 3 to 4 (#1690)
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 3 to 4.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-04 22:40:54 +01:00
a831da5886 chore: bump commons-io:commons-io from 2.14.0 to 2.15.1 (#1689)
Bumps commons-io:commons-io from 2.14.0 to 2.15.1.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-04 22:33:27 +01:00
fd5189c102 chore: bump com.diffplug.spotless:spotless-maven-plugin (#1688)
Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 2.38.0 to 2.41.1.
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/lib/2.38.0...maven/2.41.1)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-04 22:24:53 +01:00
ae261f201a feat: show directly requested file in requests overview
When a call directly hits a file it is now show up in the requests overview. This helps the user whether an attack from WebGoat actually requested the uploaded file.

Closes: gh-1551
2023-12-04 21:34:16 +01:00
3d651526be feat: show creating time in file upload overview
Closes: gh-1551
2023-12-04 21:32:02 +01:00
c7c2a61f65 chore: fix startup message (#1687)
Since we use two application context, the event listener would print out the last one with the WebWolf context. As WebWolf is part of WebGoat we should not refer to it anymore during startup as users should always go to WebGoat first.
2023-12-04 07:59:29 +01:00
b7f657ad2c chore: fix WebWolf UI (#1686)
Fix-ups after the Bootstrap 5 upgrade for WebWolf.
2023-12-02 12:59:56 +01:00
7fea42afe9 Fix/state of software supply chain links (#1683)
* fix:update state of software supply chain links

* fix:fix second link

* fix:links formatting

---------

Co-authored-by: maurycupitt <maury@cupitt.com>
2023-11-27 15:33:14 +01:00
826887cc83 Consistent environment values and url references (#1677)
* organizing environment variables

* Update application-webgoat.properties

* Update pom.xml

* test without ssl

* fix docker base image and default env entries

* seperate server.address from webgoat.host and webwolf.host

* change base image and enable endpoint logging for docker as well

* change README

* change README

* make integration test able to verify against alternative host names

* use dynamic ports and remove system println
2023-11-27 14:35:49 +01:00
62db86246e chore: back to snapshot 2023-11-23 22:34:34 +01:00
f7a9995fe0 chore: create release v2023.5 2023-11-23 16:05:13 +01:00
d6c4e8e454 chore: bump docker/build-push-action from 4.1.1 to 5.1.0 (#1670)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4.1.1 to 5.1.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v4.1.1...v5.1.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-11-20 15:11:59 +01:00
26628a39e1 chore: bump org.apache.commons:commons-compress from 1.23.0 to 1.25.0 (#1672)
Bumps org.apache.commons:commons-compress from 1.23.0 to 1.25.0.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-compress
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-11-20 15:05:36 +01:00
2d26a318d1 chore: bump org.owasp:dependency-check-maven from 6.5.1 to 8.4.3 (#1671)
Bumps [org.owasp:dependency-check-maven](https://github.com/jeremylong/DependencyCheck) from 6.5.1 to 8.4.3.
- [Release notes](https://github.com/jeremylong/DependencyCheck/releases)
- [Changelog](https://github.com/jeremylong/DependencyCheck/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jeremylong/DependencyCheck/compare/v6.5.1...v8.4.3)

---
updated-dependencies:
- dependency-name: org.owasp:dependency-check-maven
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-20 14:55:37 +01:00
dc16e9a0fb fix: typo in WebGoad.txt (#1667)
Signed-off-by: Agustín Díaz <agustin.ramiro.diaz@gmail.com>
2023-11-17 18:59:02 +01:00
88a321c268 search box moved and jwt encode/decode with little delay (#1664) 2023-11-16 14:42:10 +01:00
8450c5a5be skip validation for JWT (#1663)
* skip validation for JWT

* skip validation for JWT

* skip validation for JWT
2023-11-15 18:30:14 +01:00
ba75e10efd fixed issue in JWT test tool and added robot test (#1658) 2023-11-14 18:14:48 +01:00
d1e44bbc98 Password reset link test condition more strict and move all WebWolf links to /WebWolf (#1645)
* better check on host and port for password reset and make context roots more flexible

* spotless applied

* removed hardcoded /WebGoat from js

* removed hardcoded /WebGoat from js

* fix spotless

* fix scoreboard

* upgrade WebWolf bootstrap version and icons and templates - part 1

* fixed more bootstrap 5 style issues and context path issues

* organized WebSecurityConfig based on latest conventions and added basic support for oauth (more work needed)

* spotless applied

* added mock bean

* requires updates to properties - commented for now

* requires updates to properties - commented for now

* oauth secrets through env values

* user creation after oauth login

* integration test against non default context paths

* adjusted StartupMessage

* add global model element username

* conditionally show login oauth links

* fixed WebWolf login

---------

Co-authored-by: René Zubcevic <rene@Mac-mini-van-Rene.local>
2023-11-14 10:01:59 +01:00
5a4974f3c2 chore: bump org.apache.maven.plugins:maven-checkstyle-plugin (#1640)
Bumps [org.apache.maven.plugins:maven-checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) from 3.3.0 to 3.3.1.
- [Commits](https://github.com/apache/maven-checkstyle-plugin/compare/maven-checkstyle-plugin-3.3.0...maven-checkstyle-plugin-3.3.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-checkstyle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-02 08:13:39 +01:00
4fc1d1fb22 chore: bump org.apache.maven.plugins:maven-surefire-plugin (#1641)
Bumps [org.apache.maven.plugins:maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.1.2 to 3.2.1.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.1.2...surefire-3.2.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-02 07:26:26 +01:00
084a105c69 Java 21 initial support (#1622)
* check java 17 and 21 in build

* build on regular branch push

* build on regular branch push

* build on regular branch push

* update spring boot for Java21 support
2023-10-23 20:21:00 +02:00
7485cb8b9a chore: bump org.webjars:bootstrap from 3.3.7 to 5.3.2 (#1624)
* chore: bump org.webjars:bootstrap from 3.3.7 to 5.3.2

Bumps [org.webjars:bootstrap](https://github.com/webjars/bootstrap) from 3.3.7 to 5.3.2.
- [Commits](https://github.com/webjars/bootstrap/compare/bootstrap-3.3.7...bootstrap-5.3.2)

---
updated-dependencies:
- dependency-name: org.webjars:bootstrap
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* small update and ignore major updates

* small update and ignore major updates

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-10-23 20:09:48 +02:00
c312ae989f chore: bump docker/setup-buildx-action from 2 to 3 (#1628)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-23 17:12:25 +02:00
5fde7fbf29 chore: bump docker/login-action from 2.2.0 to 3.0.0 (#1630)
Bumps [docker/login-action](https://github.com/docker/login-action) from 2.2.0 to 3.0.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2.2.0...v3.0.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-10-23 17:03:54 +02:00
a32c56bfc7 chore: bump actions/first-interaction from 1.1.1 to 1.2.0 (#1629)
Bumps [actions/first-interaction](https://github.com/actions/first-interaction) from 1.1.1 to 1.2.0.
- [Release notes](https://github.com/actions/first-interaction/releases)
- [Commits](https://github.com/actions/first-interaction/compare/v1.1.1...v1.2.0)

---
updated-dependencies:
- dependency-name: actions/first-interaction
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-10-23 16:57:16 +02:00
6fd3eb57eb chore: bump com.google.guava:guava from 32.1.1-jre to 32.1.3-jre (#1627)
Bumps [com.google.guava:guava](https://github.com/google/guava) from 32.1.1-jre to 32.1.3-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-10-23 16:49:02 +02:00
1743d017ff chore: bump commons-io:commons-io from 2.13.0 to 2.14.0 (#1626)
Bumps commons-io:commons-io from 2.13.0 to 2.14.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-23 16:25:45 +02:00
2b2638943b chore: bump org.jacoco:jacoco-maven-plugin from 0.8.10 to 0.8.11 (#1625)
Bumps [org.jacoco:jacoco-maven-plugin](https://github.com/jacoco/jacoco) from 0.8.10 to 0.8.11.
- [Release notes](https://github.com/jacoco/jacoco/releases)
- [Commits](https://github.com/jacoco/jacoco/compare/v0.8.10...v0.8.11)

---
updated-dependencies:
- dependency-name: org.jacoco:jacoco-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-10-23 16:18:27 +02:00
45c26d8aaf Fix servers id (#1619) 2023-10-22 15:25:52 +02:00
be30551850 fix: potential NPE in the stored XSS assignment 2023-08-27 14:31:35 +02:00
49862f6b90 fix: fixes the default change in trailing slash matching and address the affected assignments 2023-08-27 14:14:27 +02:00
4009785bb8 fix: crypto basics broken links 2023-08-27 13:16:08 +02:00
d8341c86a1 bug: fix hint that was breaking the template, causing hints from different assignments to mix (#1424) 2023-08-27 02:08:52 +02:00
055578893d feat: improve MFAC lesson hint texts for a better user experience (#1424) 2023-08-27 02:08:52 +02:00
b89ebd70ad chore: bump webdrivermanager from 5.3.2 to 5.3.3
Bumps [webdrivermanager](https://github.com/bonigarcia/webdrivermanager) from 5.3.2 to 5.3.3.
- [Release notes](https://github.com/bonigarcia/webdrivermanager/releases)
- [Changelog](https://github.com/bonigarcia/webdrivermanager/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bonigarcia/webdrivermanager/compare/webdrivermanager-5.3.2...webdrivermanager-5.3.3)

---
updated-dependencies:
- dependency-name: io.github.bonigarcia:webdrivermanager
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-08-27 00:34:41 +02:00
7b81247dd1 fix: HijackSession lesson template deprecated Tymeleaf attribute 2023-08-26 02:57:50 +02:00
3bc2e57c9c Fix NPE in IDOR lesson 2023-08-26 02:22:33 +02:00
c3ec168d59 Add new assignment IT tests 2023-08-26 01:30:17 +02:00
a67fbf5a5a fix: XSS mitigation 2023-08-26 01:30:17 +02:00
3365c8d447 Remove wrong files 2023-08-25 22:50:40 +02:00
368c046779 fix: Stored Cross-Site Scripting Lesson 2023-08-25 20:55:26 +02:00
8749137d1e chore: bump org.webjars:jquery from 3.6.4 to 3.7.0
Bumps [org.webjars:jquery](https://github.com/webjars/jquery) from 3.6.4 to 3.7.0.
- [Commits](https://github.com/webjars/jquery/compare/jquery-3.6.4...jquery-3.7.0)

---
updated-dependencies:
- dependency-name: org.webjars:jquery
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-08-25 00:31:04 +02:00
786cabd251 Make webjar dependencies version agnostic 2023-08-24 16:43:28 +02:00
dda8b10f55 chore: bump org.jruby:jruby from 9.4.2.0 to 9.4.3.0
Bumps org.jruby:jruby from 9.4.2.0 to 9.4.3.0.

---
updated-dependencies:
- dependency-name: org.jruby:jruby
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-08-19 00:20:59 +02:00
d6ca083529 chore: bump commons-io:commons-io from 2.11.0 to 2.13.0
Bumps commons-io:commons-io from 2.11.0 to 2.13.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-08-18 16:15:17 +02:00
7c92d625dd doc: fix version strings
Replace `2023.3` with `2023.4`
2023-08-16 15:59:23 +02:00
4ba818533c fix: WebWolf JWT jquery webjar 2023-08-09 01:32:03 +02:00
a9b1fd66b8 feat: implement JWT jku example (#1552)
Closes #1539
2023-08-08 17:18:22 +02:00
8f6e47e6d4 chore: bump com.nulab-inc:zxcvbn from 1.7.0 to 1.8.0 (#1542)
Bumps [com.nulab-inc:zxcvbn](https://github.com/nulab/zxcvbn4j) from 1.7.0 to 1.8.0.
- [Release notes](https://github.com/nulab/zxcvbn4j/releases)
- [Changelog](https://github.com/nulab/zxcvbn4j/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nulab/zxcvbn4j/compare/1.7.0...1.8.0)

---
updated-dependencies:
- dependency-name: com.nulab-inc:zxcvbn
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-08-04 16:34:49 +02:00
61de52840f chore: bump com.diffplug.spotless:spotless-maven-plugin from 2.33.0 to 2.38.0 (#1535)
* chore: bump com.diffplug.spotless:spotless-maven-plugin

Bumps [com.diffplug.spotless:spotless-maven-plugin](https://github.com/diffplug/spotless) from 2.33.0 to 2.38.0.
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/lib/2.33.0...lib/2.38.0)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: format code

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Nanne Baars <nanne.baars@owasp.org>
2023-07-30 15:10:31 +02:00
fd3eb2451c chore: bump guava from 31.1-jre to 32.1.1-jre (#1530)
Bumps [guava](https://github.com/google/guava) from 31.1-jre to 32.1.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-29 12:35:06 +02:00
32fa1ec0a6 chore: bump jquery from 3.5.1 to 3.6.4 (#1529)
Bumps [jquery](https://github.com/webjars/jquery) from 3.5.1 to 3.6.4.
- [Commits](https://github.com/webjars/jquery/compare/jquery-3.5.1...jquery-3.6.4)

---
updated-dependencies:
- dependency-name: org.webjars:jquery
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-07-27 13:04:46 +02:00
ad00119b0d Add Assignment7 Tests 2023-07-18 00:38:23 +02:00
25f49537e7 bug: Fix IDOR lesson 2023-07-16 17:14:27 +02:00
8cb735e623 chore: bump joonvena/robotframework-reporter-action from 2.1 to 2.2
Bumps [joonvena/robotframework-reporter-action](https://github.com/joonvena/robotframework-reporter-action) from 2.1 to 2.2.
- [Release notes](https://github.com/joonvena/robotframework-reporter-action/releases)
- [Commits](https://github.com/joonvena/robotframework-reporter-action/compare/v2.1...v2.2)

---
updated-dependencies:
- dependency-name: joonvena/robotframework-reporter-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-07-16 16:01:06 +02:00
155a40aab4 chore: bump docker/build-push-action from 4.1.0 to 4.1.1
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4.1.0 to 4.1.1.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v4.1.0...v4.1.1)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-07-16 15:55:22 +02:00
6c4ddbbaad chore: bump maven-surefire-plugin from 3.1.0 to 3.1.2
Bumps [maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.1.0 to 3.1.2.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.1.0...surefire-3.1.2)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-07-16 15:41:25 +02:00
d704f69879 chore: bump commons-compress from 1.22 to 1.23.0 (#1514)
Bumps commons-compress from 1.22 to 1.23.0.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-compress
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-07-15 09:28:40 +02:00
3b2b613aa5 chore: bump asciidoctorj from 2.5.3 to 2.5.10 (#1498)
Bumps [asciidoctorj](https://github.com/asciidoctor/asciidoctorj) from 2.5.3 to 2.5.10.
- [Release notes](https://github.com/asciidoctor/asciidoctorj/releases)
- [Changelog](https://github.com/asciidoctor/asciidoctorj/blob/v2.5.10/CHANGELOG.adoc)
- [Commits](https://github.com/asciidoctor/asciidoctorj/compare/v2.5.3...v2.5.10)

---
updated-dependencies:
- dependency-name: org.asciidoctor:asciidoctorj
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-18 20:21:53 +02:00
934ba3e496 fix: remove steps from release script (#1509)
Closes gh-1383
2023-06-18 20:13:38 +02:00
8ec718c1ef format 2023-06-15 19:26:33 +02:00
1df7ca61a3 Text content improvement 2023-06-15 19:26:33 +02:00
75398feca0 Add hints 2023-06-15 19:26:33 +02:00
76a2365abf chore: bump docker/setup-qemu-action from 2.1.0 to 2.2.0 (#1503)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-14 10:31:00 +02:00
015216df5f chore: bump docker/login-action from 2.1.0 to 2.2.0 (#1502)
Bumps [docker/login-action](https://github.com/docker/login-action) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-13 17:06:35 +02:00
60fc807d36 chore: bump docker/build-push-action from 4.0.0 to 4.1.0 (#1501)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v4.0.0...v4.1.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-13 10:50:53 +02:00
636a2bdaf5 fix: robotframework fails due to updated dependencies (#1508) 2023-06-13 10:00:50 +02:00
816a694c84 chore: bump maven-surefire-plugin from 3.0.0-M9 to 3.1.0 (#1499)
Bumps [maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.0.0-M9 to 3.1.0.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.0.0-M9...surefire-3.1.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-06-07 21:31:54 +02:00
06a55ab278 chore: bump maven-checkstyle-plugin from 3.2.1 to 3.3.0 (#1496)
Bumps [maven-checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) from 3.2.1 to 3.3.0.
- [Commits](https://github.com/apache/maven-checkstyle-plugin/compare/maven-checkstyle-plugin-3.2.1...maven-checkstyle-plugin-3.3.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-checkstyle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-06-07 09:41:13 +02:00
0136c1070f chore: bump spring-boot-starter-parent from 3.0.5 to 3.1.0 (#1497)
Bumps [spring-boot-starter-parent](https://github.com/spring-projects/spring-boot) from 3.0.5 to 3.1.0.
- [Release notes](https://github.com/spring-projects/spring-boot/releases)
- [Commits](https://github.com/spring-projects/spring-boot/compare/v3.0.5...v3.1.0)

---
updated-dependencies:
- dependency-name: org.springframework.boot:spring-boot-starter-parent
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-06 16:21:11 +02:00
dce5eeb797 bug: fix Java image inside Docker file
The image now downloads the correct Java version based on the architecture.
2023-06-04 14:56:46 +02:00
ca886b4818 feat: upgrade to Spring Boot version 3 (#1477) 2023-06-04 11:19:47 +02:00
ff3a2983e2 chore: bump zxcvbn from 1.5.2 to 1.7.0 (#1471)
Bumps [zxcvbn](https://github.com/nulab/zxcvbn4j) from 1.5.2 to 1.7.0.
- [Release notes](https://github.com/nulab/zxcvbn4j/releases)
- [Changelog](https://github.com/nulab/zxcvbn4j/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nulab/zxcvbn4j/compare/1.5.2...1.7.0)

---
updated-dependencies:
- dependency-name: com.nulab-inc:zxcvbn
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-06-02 16:21:17 +02:00
6f0b88f9b6 chore: bump cglib-nodep from 2.2 to 3.3.0 (#1470)
Bumps [cglib-nodep](https://github.com/cglib/cglib) from 2.2 to 3.3.0.
- [Release notes](https://github.com/cglib/cglib/releases)
- [Commits](https://github.com/cglib/cglib/commits)

---
updated-dependencies:
- dependency-name: cglib:cglib-nodep
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-06-02 16:06:55 +02:00
9d9fb092be chore: bump maven-enforcer-plugin from 3.2.1 to 3.3.0 (#1468)
Bumps [maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.2.1 to 3.3.0.
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.2.1...enforcer-3.3.0)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-06-02 09:01:54 +02:00
4bc53a6666 chore: bump maven-checkstyle-plugin from 3.1.2 to 3.2.1 (#1472)
Bumps [maven-checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) from 3.1.2 to 3.2.1.
- [Release notes](https://github.com/apache/maven-checkstyle-plugin/releases)
- [Commits](https://github.com/apache/maven-checkstyle-plugin/compare/maven-checkstyle-plugin-3.1.2...maven-checkstyle-plugin-3.2.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-checkstyle-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: René Zubcevic <rene@zubcevic.com>
2023-06-02 08:54:21 +02:00
61d5fb9ece chore: bump jsoup from 1.15.4 to 1.16.1 (#1484)
Bumps [jsoup](https://github.com/jhy/jsoup) from 1.15.4 to 1.16.1.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES)
- [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.15.4...jsoup-1.16.1)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-06-02 08:43:43 +02:00
6eafa45e4c chore: bump jacoco-maven-plugin from 0.8.8 to 0.8.10
Bumps [jacoco-maven-plugin](https://github.com/jacoco/jacoco) from 0.8.8 to 0.8.10.
- [Release notes](https://github.com/jacoco/jacoco/releases)
- [Commits](https://github.com/jacoco/jacoco/compare/v0.8.8...v0.8.10)

---
updated-dependencies:
- dependency-name: org.jacoco:jacoco-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-05-01 23:48:16 +02:00
ac6de9d788 Fix typo of HijackSession_content0.adoc 2023-04-17 09:04:15 +02:00
f6855bf6a5 chore: bump guava from 30.1-jre to 31.1-jre (#1448)
Bumps [guava](https://github.com/google/guava) from 30.1-jre to 31.1-jre.
- [Release notes](https://github.com/google/guava/releases)
- [Commits](https://github.com/google/guava/commits)

---
updated-dependencies:
- dependency-name: com.google.guava:guava
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-06 11:55:22 +02:00
f7b4af5023 chore: bump bootstrap from 3.3.7 to 5.2.3 (#1441)
Bumps [bootstrap](https://github.com/webjars/bootstrap) from 3.3.7 to 5.2.3.
- [Release notes](https://github.com/webjars/bootstrap/releases)
- [Commits](https://github.com/webjars/bootstrap/compare/bootstrap-3.3.7...bootstrap-5.2.3)

---
updated-dependencies:
- dependency-name: org.webjars:bootstrap
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-06 11:55:08 +02:00
e720eec5f9 chore: bump jruby from 9.3.6.0 to 9.4.2.0 (#1454)
Bumps jruby from 9.3.6.0 to 9.4.2.0.

---
updated-dependencies:
- dependency-name: org.jruby:jruby
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-06 11:54:51 +02:00
a43a6125e8 chore: bump actions/cache from 3.2.6 to 3.3.1 (#1453)
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.6 to 3.3.1.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.2.6...v3.3.1)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-06 11:54:05 +02:00
d3e2164716 chore: bump asm from 9.1 to 9.5 (#1460)
Bumps asm from 9.1 to 9.5.

---
updated-dependencies:
- dependency-name: org.ow2.asm:asm
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-04-06 11:53:50 +02:00
cbf2e153d9 Restrict SSRF Regexes 2023-03-08 23:22:38 +01:00
0795ff0fc5 chore: bump commons-io from 2.6 to 2.11.0
Bumps commons-io from 2.6 to 2.11.0.

---
updated-dependencies:
- dependency-name: commons-io:commons-io
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-03-01 11:09:19 +01:00
d7cdfeec2a chore: bump webdrivermanager from 4.3.1 to 5.3.2
Bumps [webdrivermanager](https://github.com/bonigarcia/webdrivermanager) from 4.3.1 to 5.3.2.
- [Release notes](https://github.com/bonigarcia/webdrivermanager/releases)
- [Changelog](https://github.com/bonigarcia/webdrivermanager/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bonigarcia/webdrivermanager/compare/webdrivermanager-4.3.1...webdrivermanager-5.3.2)

---
updated-dependencies:
- dependency-name: io.github.bonigarcia:webdrivermanager
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-03-01 11:09:08 +01:00
491fe2d84d chore: bump maven-enforcer-plugin from 3.0.0 to 3.2.1
Bumps [maven-enforcer-plugin](https://github.com/apache/maven-enforcer) from 3.0.0 to 3.2.1.
- [Release notes](https://github.com/apache/maven-enforcer/releases)
- [Commits](https://github.com/apache/maven-enforcer/compare/enforcer-3.0.0...enforcer-3.2.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-enforcer-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-03-01 11:08:28 +01:00
a509e8e24e chore: bump commons-text from 1.9 to 1.10.0
Bumps commons-text from 1.9 to 1.10.0.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-text
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-03-01 11:07:37 +01:00
e50986a098 fix: challenge 7 (#1433) 2023-02-22 22:55:48 +01:00
61dac201f0 Add coverage profile 2023-02-22 14:51:55 +01:00
c5629be618 chore: bump spotless-maven-plugin from 2.29.0 to 2.33.0 (#1426)
Bumps [spotless-maven-plugin](https://github.com/diffplug/spotless) from 2.29.0 to 2.33.0.
- [Release notes](https://github.com/diffplug/spotless/releases)
- [Changelog](https://github.com/diffplug/spotless/blob/main/CHANGES.md)
- [Commits](https://github.com/diffplug/spotless/compare/lib/2.29.0...lib/2.33.0)

---
updated-dependencies:
- dependency-name: com.diffplug.spotless:spotless-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:36:24 +01:00
df8c83fe74 chore: bump eclipse-temurin from 17-jre-focal to 19-jre-focal (#1427)
Bumps eclipse-temurin from 17-jre-focal to 19-jre-focal.

---
updated-dependencies:
- dependency-name: eclipse-temurin
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:36:07 +01:00
6d3813c2ce chore: bump commons-compress from 1.21 to 1.22 (#1428)
Bumps commons-compress from 1.21 to 1.22.

---
updated-dependencies:
- dependency-name: org.apache.commons:commons-compress
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:35:52 +01:00
ecfa0197af chore: bump maven-surefire-plugin from 3.0.0-M5 to 3.0.0-M9 (#1429)
Bumps [maven-surefire-plugin](https://github.com/apache/maven-surefire) from 3.0.0-M5 to 3.0.0-M9.
- [Release notes](https://github.com/apache/maven-surefire/releases)
- [Commits](https://github.com/apache/maven-surefire/compare/surefire-3.0.0-M5...surefire-3.0.0-M9)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-surefire-plugin
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:35:36 +01:00
8467ae8a0b chore: bump jsoup from 1.14.3 to 1.15.4 (#1430)
Bumps [jsoup](https://github.com/jhy/jsoup) from 1.14.3 to 1.15.4.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES)
- [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.14.3...jsoup-1.15.4)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:35:20 +01:00
5243fa2bf2 chore: bump jose4j from 0.7.6 to 0.9.3 (#1431)
Bumps [jose4j](https://bitbucket.org/b_c/jose4j) from 0.7.6 to 0.9.3.
- [Commits](https://bitbucket.org/b_c/jose4j/branches/compare/jose4j-0.9.3..jose4j-0.7.6)

---
updated-dependencies:
- dependency-name: org.bitbucket.b_c:jose4j
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-02-22 13:35:01 +01:00
36f99dede8 Bump actions/cache from 3.2.5 to 3.2.6
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.5 to 3.2.6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.2.5...v3.2.6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-02-22 13:34:10 +01:00
5dbe2eaf19 refactor: update challenge code
- Flags are now wired through a Spring config
- Introduced Flag class
- Removed Flags from the FlagController
2023-02-22 11:01:34 +01:00
1b49b2fd3b chore: format markdown file 2023-02-22 11:01:34 +01:00
b49c61636b ci: add maven and docker to dependabot configuration 2023-02-22 11:01:34 +01:00
8269207d6b docs: add documentation we start using Conventional Commits.
Fixes #1022
2023-02-22 11:01:34 +01:00
de2f568229 chore: back to snapshot version after release 2023-02-22 11:01:34 +01:00
9f6cf39ff2 ci: add distribution in snapshot job 2023-02-22 11:01:34 +01:00
19d54dbe95 chore: release version 2023.4 2023-02-22 11:01:34 +01:00
0f38519ecf ci: add step for pushing Docker desktop image 2023-02-17 12:56:43 +01:00
4c95c9ec6a ci: add step to build and verify Docker image 2023-02-17 12:56:43 +01:00
f6c7a54931 docs: add screenshot to README and add Docker WebGoat desktop text 2023-02-17 12:56:43 +01:00
f1012c85d6 feat: add Docker desktop version of WebGoat with all tools installed
The new Docker image uses linuxserver/webtop giving users the opportunity
to run a Linux desktop in their browser without installing any tools
on their local machine.
2023-02-17 12:56:43 +01:00
ecfc321f14 feature: Add extra feedback once someone solves JWT refresh lesson differently
One can solve this lesson by using `alg:none` instead of using the refresh token flow. Instead of adding a check to force using the refresh token we opt for giving the user extra feedback.
2023-02-16 20:32:27 +00:00
73b8c431fc chore: use constructor instead of field dependency injection 2023-02-16 20:32:27 +00:00
b68adfbc7c Bump devops-infra/action-pull-request from 0.5.3 to 0.5.5
Bumps [devops-infra/action-pull-request](https://github.com/devops-infra/action-pull-request) from 0.5.3 to 0.5.5.
- [Release notes](https://github.com/devops-infra/action-pull-request/releases)
- [Commits](https://github.com/devops-infra/action-pull-request/compare/v0.5.3...v0.5.5)

---
updated-dependencies:
- dependency-name: devops-infra/action-pull-request
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-02-16 14:09:05 +00:00
1a2855afcd chore: set directories explicitly when running IT tests 2023-02-16 12:24:02 +00:00
693771220c fix: change url in JavaScript for JWT endpoint
The JavaScript pointed to the context root /WebWolf/ which is no longer in use.
2023-02-16 12:24:02 +00:00
075b1ab30a Fix WebWolf JWT tool 2023-02-15 22:40:24 +00:00
390ff39f19 chore: format src/test/it as well 2023-02-15 19:01:06 +00:00
3ec34b0df5 fix: challenge test fails sometimes when calling scoreboard endpoint 2023-02-15 19:01:06 +00:00
eb4c8388f8 Update Dockerfile 2023-02-15 12:11:12 +00:00
ae081ce319 Add fileserver location (test) 2023-02-15 12:00:54 +00:00
bd398e4c09 #1396 Fix templates path for views 2023-02-15 11:58:49 +00:00
c9d1653d4f Bump docker/build-push-action from 3.2.0 to 4.0.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 3.2.0 to 4.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v3.2.0...v4.0.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-02-10 21:39:35 +01:00
77c91b8df8 Bump actions/cache from 3.2.3 to 3.2.5
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.3 to 3.2.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.2.3...v3.2.5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-02-10 21:38:56 +01:00
f9b810c5ee Fix formatting issue 2023-01-14 18:29:24 +01:00
dc0fc09679 Move to main and skip develop
Using main and develop imposes a complicated release process with Gitflow etc. To simplify our release process we move our development to the main branch skipping develop.
2023-01-14 18:24:35 +01:00
a0173fd8f8 Merge branch 'develop' 2023-01-14 17:07:37 +01:00
58e7e9d4ef Bump actions/cache from 3.2.2 to 3.2.3
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.2 to 3.2.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.2.2...v3.2.3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-01-11 20:59:09 +01:00
c7a41d1b17 Merge branch 'release/v2023.3' into develop 2023-01-05 21:59:37 +01:00
edd9aa36c2 Merge branch 'release/v2023.3' 2023-01-05 21:59:29 +01:00
27fe1850de Preparing new release 2023-01-05 21:59:01 +01:00
5c2bbd1227 Fix jar path while creating a release 2023-01-05 21:57:08 +01:00
683b629663 Back to snapshot 2023-01-05 21:52:40 +01:00
04908a81e7 Add change log URL 2023-01-05 21:51:45 +01:00
701de68ef2 Merge branch 'release/v2023.2' into develop 2023-01-05 21:37:28 +01:00
81ed738493 Merge branch 'release/v2023.2' 2023-01-05 21:37:21 +01:00
c03d153978 New release 2023-01-05 21:36:48 +01:00
6ab04db2ee Merge branch 'release/v2023.1' into develop 2023-01-05 21:06:36 +01:00
a108a937b5 Merge branch 'release/v2023.1' 2023-01-05 21:06:22 +01:00
6d5ea57606 New release 2023-01-05 21:02:26 +01:00
79fd88eeb6 Use Java 17 2023-01-05 21:00:43 +01:00
64b10c1a59 Merge branch 'release/v2023.0' into develop 2023-01-05 20:52:02 +01:00
6398d31c14 Merge branch 'release/v2023.0' 2023-01-05 20:51:53 +01:00
716a7dd9ea Preparing release 2023.0 2023-01-05 20:51:34 +01:00
323daae578 Vulnerable components only work in a Docker container 2023-01-05 20:51:15 +01:00
bdbf66c8e1 Merge branch 'release/v2023.1' into develop 2023-01-05 20:38:54 +01:00
174a59c35a Preparing release 2023.1 2023-01-05 20:38:20 +01:00
a08e515f6d Merge branch 'release/v2023.0' into develop 2023-01-05 20:35:02 +01:00
f766edcfcb Preparing release 2023.0 2023-01-05 20:31:24 +01:00
3901814363 Fix documentation link for XXE mitigation. 2023-01-05 19:00:12 +01:00
59bfd7c6d4 Move XXE to A05 - Security Misconfiguration 2023-01-05 19:00:12 +01:00
11776e1d6a Remove explicit goal for code formatting
`mvn verify` already checks formatting, having a separate step is not necessary. We now also check Markdown files for correct formatting.
2023-01-05 18:18:52 +01:00
7664625afa Add documentation about reusing the container.
The documentation now contains a description to reuse the initially create container. This way the user can start where they left off. The documentation only described creating a new container each and every time leaving users to create a new login each and every time.

Add documentation about reusing the container.

The documentation now contains a description to reuse the initially create container. This way the user can start where they left off. The documentation only described creating a new container each and every time leaving users to create a new login each and every time.
2023-01-05 18:18:52 +01:00
dca415099f Remove unused JavaScript function 2023-01-05 11:33:00 +01:00
54e115aff0 Update the solution with WebWolf URLs
The new solution uses WebWolf paths as these will change automatically when a user start WebGoat on a different port. It no longer depends on the hardcoded port `8080`.
2023-01-05 11:02:45 +01:00
fcaa2d8589 Fix zip slip lesson.
The lesson did not work properly as the directory is reused across several path traversal lessons. First thing before uploading the zip file we now clean the directory.

The html had a reference to a location of the profile picture, this was part of a hint but this only causes confusion as this is not indicating to where you need to upload the picture with the Zip Slip vulnerability.

The assignment now contains a direct hint as where the image needs to be saved. The assignment is about creating a vulnerable zip file and NOT about guessing where the image should be saved inside WebGoat.
2023-01-05 11:02:45 +01:00
9666597164 - Add reference to the WebWolf icon in the top right corner.
- Format all text of the lesson
2023-01-04 08:07:51 +01:00
d2a1546dff Apply formatting
This will make sure we have a consistent style across our project and the PRs are only concerned with actual changes and no longer about style.
2023-01-04 08:07:23 +01:00
b03777d39b Support boolean when parsing the token.
When the admin json element passes as a `boolean`:

```
{
 "admin": true
}
```

the parsing is now successful.
2023-01-04 07:43:18 +01:00
32468ff90b Add sql lesson (#1370) 2023-01-04 07:42:29 +01:00
614235d913 Bump actions/cache from 3.2.1 to 3.2.2 (#1369)
Bumps [actions/cache](https://github.com/actions/cache) from 3.2.1 to 3.2.2.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.2.1...v3.2.2)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-31 16:28:31 +01:00
9abf4ef2ea Bump actions/cache from 3.0.11 to 3.2.1 (#1368)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.11 to 3.2.1.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.11...v3.2.1)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-27 18:00:54 +01:00
6a18ee80be Added info about login in the ReadMe file 2022-12-06 14:07:05 +01:00
71ec36102f Fix typo 2022-12-01 21:34:19 +01:00
8db9ff30be Fixed incorrect word
while "wear" and "were" have similar pronunciation, one of them is better here than the other :)
2022-11-29 18:55:44 +01:00
b51be74cab typofix 2022-11-28 17:10:14 +01:00
d4e3c9b91c Bump actions/cache from 3.0.10 to 3.0.11
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.10 to 3.0.11.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.10...v3.0.11)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-23 10:06:24 +02:00
87358d4238 Bump docker/setup-qemu-action from 2.0.0 to 2.1.0
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v2.0.0...v2.1.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-23 10:06:13 +02:00
3bc5309a1c Bump docker/build-push-action from 3.1.1 to 3.2.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 3.1.1 to 3.2.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v3.1.1...v3.2.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-23 10:05:56 +02:00
8ec69d0a41 Bump docker/login-action from 2.0.0 to 2.1.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 2.0.0 to 2.1.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2.0.0...v2.1.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-23 10:05:44 +02:00
1f567749bd Bump actions/first-interaction from 1.1.0 to 1.1.1
Bumps [actions/first-interaction](https://github.com/actions/first-interaction) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/actions/first-interaction/releases)
- [Commits](https://github.com/actions/first-interaction/compare/v1.1.0...v1.1.1)

---
updated-dependencies:
- dependency-name: actions/first-interaction
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-10-23 10:05:32 +02:00
ea892dbcb2 Bump actions/cache from 3.0.8 to 3.0.10 (#1342)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.8 to 3.0.10.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.8...v3.0.10)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-05 11:24:44 +02:00
96c2595ad0 Update interface name to exploit
The name is
org.owasp.webgoat.lessons.vulnerablecomponents.Contact
not
org.owasp.webgoat.vulnerablecomponents.Contact
2022-09-21 22:32:16 +02:00
34f5b79249 isReadable works inside a container, isFile not (#1334) 2022-09-12 09:02:07 +02:00
f5e4d4717a FixTypo - Fix typo in various lesson documentations 2022-08-30 22:21:22 +02:00
de3c2c8d85 Bump actions/cache from 3.0.6 to 3.0.8
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.6 to 3.0.8.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.6...v3.0.8)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-08-27 16:44:51 +02:00
975cbf5769 Bump docker/build-push-action from 3.1.0 to 3.1.1 (#1321)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 3.1.0 to 3.1.1.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v3.1.0...v3.1.1)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-08 20:06:48 +02:00
3308f89acc Bump actions/cache from 3.0.5 to 3.0.6 (#1320)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.5 to 3.0.6.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.5...v3.0.6)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-08-06 21:59:58 +02:00
50f932b02e Renamed to webwolfintroduction 2022-07-31 22:39:21 +02:00
251167c6b0 Renamed to webgoatintroduction 2022-07-31 22:39:21 +02:00
256c1dd3aa Renamed to vulnerablecomponents 2022-07-31 22:39:21 +02:00
b93c935d6c Renamed to sqlinjection 2022-07-31 22:39:21 +02:00
827a9d3467 Renamed to securepasswords 2022-07-31 22:39:21 +02:00
91470b93ea Renamed to pathtraversal 2022-07-31 22:39:21 +02:00
37d684fdd3 Renamed to passwordreset 2022-07-31 22:39:21 +02:00
4f911c64a1 Renamed to missingac 2022-07-31 22:39:21 +02:00
e0a0a80ad9 Renamed to lessontemplate 2022-07-31 22:39:21 +02:00
26c289d7d4 Renamed to insecurelogin 2022-07-31 22:39:21 +02:00
1eff81718b Renamed to httpproxies 2022-07-31 22:39:21 +02:00
08ce1add01 Renamed to httpbasics 2022-07-31 22:39:21 +02:00
25948306bd Renamed to htmltampering 2022-07-31 22:39:21 +02:00
1c86f465dc Renamed to clientsidefiltering 2022-07-31 22:39:21 +02:00
3b330fb328 Renamed to chromedevtools 2022-07-31 22:39:21 +02:00
8a35316985 Rename to bypassrestrictions 2022-07-31 22:39:21 +02:00
c63345e4ee Rename authbypass 2022-07-31 22:39:21 +02:00
005b9f03a4 search the menu using input box (#1317)
* working version

* change onchange to oninput with minimum of three chars

* working version with delay and fix for category click
2022-07-31 20:45:09 +02:00
4d48bd3d4c fix in style sheet that now shows normal dropdown behaviour (#1315) 2022-07-27 13:44:23 +02:00
71afc6b6f3 Workflow fix (#1311)
* conditional step

* conditional step
2022-07-25 09:55:24 +02:00
242fdf39a1 Fixes #1233 - Path traversal seems to contain wrong description 2022-07-24 22:09:16 +02:00
37163a99a6 Remove unused script 2022-07-24 15:34:43 +02:00
126ead2290 Add release notes 2022-07-24 15:34:43 +02:00
928bc32f4f Update README.md 2022-07-24 15:34:08 +02:00
6b63aaf8b1 Robot framework (#1304)
* added Robot framework UI tests

* added Robot framework UI tests workflow

* Update test.yml

wait in workflow

* remove obsolete selenium java libs and test

* Update test.yml

push result to commit as comment

* Update test.yml

push comment does not seem to work on WebGoat PR

* clean up unrequired robot options

* update readme
2022-07-24 12:28:01 +02:00
c4f16ceff6 Update README.md 2022-07-23 21:56:39 +02:00
4050d1817c Move to JRE image 2022-07-23 09:39:52 +02:00
37186e1d90 Explicity add ports to Java command
This way we don't have to mention it somewhere in the documentation it is all in one command
2022-07-23 09:39:52 +02:00
06b7244de7 Move XXE lesson to category A3: Injection 2022-07-23 09:39:52 +02:00
260168bb3f Remove automatic selection of a random port 2022-07-23 09:39:52 +02:00
af9ba18040 Bump docker/build-push-action from 3.0.0 to 3.1.0 (#1302)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 3.0.0 to 3.1.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v3.0.0...v3.1.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-20 18:50:11 +02:00
20dd3ffb95 Lang switch (#1297)
* language selector first steps

* language german intro added

* ascii doc lang attribute as additional option

* removed some commented code

* changed adoc resource loader to take into account the selected language

* added readme

* added lang test cases
2022-07-20 10:52:48 +02:00
24fcc8f321 Use starting instead of using. 2022-07-19 21:17:09 +02:00
ff965c83be Adjust year 2022-07-19 21:17:09 +02:00
2aa3609461 Fix typo 2022-07-19 21:17:09 +02:00
fe7774bb6f Update documentation regarding WebWolf
WebWolf no longer runs as a separate application we can simplify the description.
2022-07-19 21:17:09 +02:00
9e3eb39069 removed one duplicate label key and made all login and register fields multi language (#1296) 2022-07-16 06:53:39 +02:00
7add1ef73e hints tested (#1295) 2022-07-15 12:44:37 +02:00
4fc03381a8 Label hint tests (#1293)
* label test

* adjusted it test filter

* label test added
2022-07-15 08:17:11 +02:00
16af4272a5 joda time refactored some dep fix (#1292) 2022-07-14 09:11:06 +02:00
b47568ed69 Bump actions/cache from 3.0.4 to 3.0.5 (#1291)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.4 to 3.0.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.4...v3.0.5)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-07-14 09:03:51 +02:00
f8b7ca5c85 Pom update (#1290)
* asciidoctorj update

* pom and suppression updates
2022-07-11 13:28:44 +02:00
e4eb5d783a Some updates and code improvements (#1288)
* try with resources

* StringBuilder

* removed ant and updated spring boot
2022-07-10 17:13:26 +02:00
7dd0dd0923 Bump actions/cache from 3.0.3 to 3.0.4 (#1270)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.3 to 3.0.4.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.3...v3.0.4)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-20 15:25:31 +02:00
aeb481e561 Bump actions/cache from 3.0.2 to 3.0.3 (#1260)
Bumps [actions/cache](https://github.com/actions/cache) from 3.0.2 to 3.0.3.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v3.0.2...v3.0.3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-06-04 18:06:55 +02:00
8a22c88d61 Bump docker/build-push-action from 2.10.0 to 3.0.0 (#1252)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.10.0 to 3.0.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v2.10.0...v3.0.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-05-18 08:36:51 +02:00
724666e10f Bump docker/setup-buildx-action from 1 to 2 (#1253)
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 1 to 2.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v1...v2)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-05-18 08:36:39 +02:00
4953dd63ed Bump docker/setup-qemu-action from 1.1.0 to 2.0.0 (#1254)
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 1.1.0 to 2.0.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](https://github.com/docker/setup-qemu-action/compare/v1.1.0...v2.0.0)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-05-18 08:36:28 +02:00
a32055995d Bump docker/login-action from 1.14.1 to 2.0.0 (#1255)
Bumps [docker/login-action](https://github.com/docker/login-action) from 1.14.1 to 2.0.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v1.14.1...v2.0.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-05-18 08:36:01 +02:00
3c0b243797 Added new active developer (#1249)
Fix footer
2022-05-06 07:34:49 +02:00
dfa31e0a28 JWT doc code typo fix (#1247) 2022-04-20 08:16:21 +02:00
b32240f96b owasp top10-2021 (#1235) 2022-04-11 21:12:41 +02:00
02c3f9551f update spring boot (#1242) 2022-04-11 21:12:10 +02:00
bc91ca86e8 Bump actions/cache from 2.1.7 to 3.0.2 (#1239)
Bumps [actions/cache](https://github.com/actions/cache) from 2.1.7 to 3.0.2.
- [Release notes](https://github.com/actions/cache/releases)
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md)
- [Commits](https://github.com/actions/cache/compare/v2.1.7...v3.0.2)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 18:14:54 +02:00
1dadf20ee0 Bump actions/checkout from 2 to 3 (#1240)
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 18:14:42 +02:00
4ff41299e3 Bump actions/setup-java from 2 to 3 (#1241)
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 2 to 3.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 18:14:28 +02:00
a9fa53535d Fix Build Badge and Link (#1238) 2022-04-11 07:45:58 +02:00
711649924b Refactoring (#1201)
* Some initial refactoring

* Make it one application

* Got it working

* Fix problem on Windows

* Move WebWolf

* Move first lesson

* Moved all lessons

* Fix pom.xml

* Fix tests

* Add option to initialize a lesson

This way we can create content for each user inside a lesson. The initialize method will be called when a new user is created or when a lesson reset happens

* Clean up pom.xml files

* Remove fetching labels based on language.

We only support English at the moment, all the lesson explanations are written in English which makes it very difficult to translate. If we only had labels it would make sense to support multiple languages

* Fix SonarLint issues

* And move it all to the main project

* Fix for documentation paths

* Fix pom warnings

* Remove PMD as it does not work

* Update release notes about refactoring

Update release notes about refactoring

Update release notes about refactoring

* Fix lesson template

* Update release notes

* Keep it in the same repo in Dockerhub

* Update documentation to show how the connection is obtained.

Resolves: #1180

* Rename all integration tests

* Remove command from Dockerfile

* Simplify GitHub actions

Currently, we use a separate actions for pull-requests and branch build.
This is now consolidated in one action.
The PR action triggers always, it now only trigger when the PR is
opened and not in draft.
Running all platforms on a branch build is a bit too much, it is better
 to only run all platforms when someone opens a PR.

* Remove duplicate entry from release notes

* Add explicit registry for base image

* Lesson scanner not working when fat jar

When running the fat jar we have to take into account we
are reading from the jar file and not the filesystem. In
this case you cannot use `getFile` for example.

* added info in README and fixed release docker

* changed base image and added ignore file

Co-authored-by: Zubcevic.com <rene@zubcevic.com>
2022-04-09 14:56:12 +02:00
f3d8206a07 Set permissions for GitHub actions (#1228)
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

 Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

Signed-off-by: neilnaveen <42328488+neilnaveen@users.noreply.github.com>
2022-04-09 12:54:32 +02:00
56f5b0f0fa Bump actions/cache from 2.1.7 to 3 (#1220)
Bumps [actions/cache](https://github.com/actions/cache) from 2.1.7 to 3.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](https://github.com/actions/cache/compare/v2.1.7...v3)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-26 14:33:06 +01:00
bed2eed8d8 Bump docker/build-push-action from 2.7.0 to 2.10.0 (#1218)
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.7.0 to 2.10.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v2.7.0...v2.10.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-26 14:32:53 +01:00
984548ae88 Bump actions/checkout from 2 to 3 (#1213)
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-09 14:52:49 +01:00
32475ea37e Bump docker/login-action from 1.13.0 to 1.14.1 (#1214)
Bumps [docker/login-action](https://github.com/docker/login-action) from 1.13.0 to 1.14.1.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v1.13.0...v1.14.1)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-09 14:52:28 +01:00
2332bf22a7 Bump docker/login-action from 1.12.0 to 1.13.0 (#1209)
Bumps [docker/login-action](https://github.com/docker/login-action) from 1.12.0 to 1.13.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v1.12.0...v1.13.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-28 07:58:56 +01:00
3bc009297e Update SessionManagementTest.java (#1198)
url() is required in this case. You will notice it when changing host name or when using https
2021-12-23 17:07:55 +01:00
44ab36aa1b Add message that WebGoat should be running while detecting datasource 2021-12-22 15:57:39 +01:00
969335f2f6 Update documentation for starting with java -jar 2021-12-22 15:57:11 +01:00
c000a9b467 Improve startup message Docker 2021-12-22 12:55:27 +01:00
c5389f31c3 Bump docker/login-action from 1.9.0 to 1.12.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 1.9.0 to 1.12.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v1.9.0...v1.12.0)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-12-21 12:53:41 +01:00
85d4633f62 Update enforcer and exclude log4j-core completely (every version) 2021-12-21 10:05:12 +01:00
7ded0968c1 Ban log4j all together and update OWASP dep check
Remove
2021-12-20 21:45:44 +01:00
cb6b1d73d1 upgrade to latest spring-boot libs and fixed related issues 2021-12-20 21:45:44 +01:00
44f70ce4dc Remove unnecessary compiler section from pom.xml as it confuses Intellij while importing 2021-12-20 16:45:06 +01:00
a42f8fcf75 No progress information for Maven 2021-12-20 16:45:06 +01:00
ac4b06f11b Move enabling security to WebGoat core and add resetting the lessons.
We can use it for more lessons and showcase how to apply security directly from the source code.

Resolves: #1176
2021-12-20 16:45:06 +01:00
705ec85f35 openshift support 2021-12-19 13:49:38 +01:00
1f1fb73f86 Style fix (#1191)
* renamed README

* rename
2021-12-18 18:06:32 +01:00
e169650ebc Update documentation 2021-12-15 17:47:12 +01:00
2589aa3fa4 Update documentation 2021-12-15 17:46:58 +01:00
51c007c545 Update documentation 2021-12-15 17:46:46 +01:00
5089c107ba Update documentation 2021-12-15 17:46:35 +01:00
69a93f30d2 update documentation 2021-12-15 17:46:24 +01:00
80e01d680b add editor config 2021-12-15 17:46:14 +01:00
0658fcefcd update documentation 2021-12-15 17:46:03 +01:00
d41d21b2e6 Update the documentation 2021-12-15 17:45:52 +01:00
939f860ddd renamed spoof-cookie form 2021-12-08 19:37:10 +01:00
d047c41e86 Update README.MD 2021-11-27 18:06:45 +01:00
8dd66fc0ff Improve Docker start up script
- Make sure the last line contains the information
- Split in separate functions
- Add option to skip starting nginx (by default it is started)
2021-11-23 13:22:19 +01:00
d496c929b3 Use variables to check WebWolf host and port
WebWolf can start on a different port, the assignment should take this into account and not check for a hardcoded value.

Resolves: #1055
2021-11-23 13:22:08 +01:00
f8dda37027 Rename properties
Rename `webwolf.url.*` to `webwolf.*.url` making it easier to move to a configuration class as no nested property is necessary
2021-11-23 13:22:08 +01:00
48fd7f310e Bump actions/cache from 2.1.5 to 2.1.7
Bumps [actions/cache](https://github.com/actions/cache) from 2.1.5 to 2.1.7.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](https://github.com/actions/cache/compare/v2.1.5...v2.1.7)

---
updated-dependencies:
- dependency-name: actions/cache
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-11-23 13:21:52 +01:00
5107e111bf test url fix 2021-11-19 13:07:49 +01:00
dd2e9f074d Hijack Session Lesson 2021-11-19 13:07:49 +01:00
ec954046db Add Discussions badge 2021-11-16 17:53:16 +01:00
6be9635f51 Update OWASP badge 2021-11-16 16:43:18 +01:00
f7dd69e382 Fix to move to java17 2021-11-16 16:39:53 +01:00
fc6b0f28df Add endpoint for the JavaScript to post to
The JavaScript posts to a random endpoint resulting in a HTTP/405 we now post to an existing endpoint.

Resolves: #1142
2021-11-16 16:34:14 +01:00
f13632578d Fix layout of assignment and remove duplicate feedback
Resolves: #1143
2021-11-16 16:34:02 +01:00
b23b428763 Fix spelling/grammar
Resolves: #1143
2021-11-16 16:34:02 +01:00
32a41debad Fix spelling/grammar and reference to ZAP 2.8.0
Resolves: #1141
2021-11-16 16:33:48 +01:00
fafddda82a Update ZAP instructions
We reference ZAP 2.8.0 explicitly which is not necessary. Also the way ZAP works changed, we no longer need to change the port as ZAP will report there is a conflict during startup.

Resolves: #1141
2021-11-16 16:33:48 +01:00
5bf33db78f Remove obsolete hints 2021-11-16 16:33:36 +01:00
20d7015dff Move unit test to JUnit 5 2021-11-16 16:33:36 +01:00
2fbc52e6a2 Remove some unused code 2021-11-16 16:33:36 +01:00
ab0433bb67 Fix link and typo
The link pointed to the old OWASP website. Also fixed some typos here and there

Resolves: #1136
2021-11-16 16:33:10 +01:00
f2f7f36a6d Fix typo in hints
The hints for JWT used `jwt` instead of `JWT` which makes it difficult to solve the lesson as the hint actually points someone in the wrong direction.

Resolves: #123
2021-11-16 16:32:57 +01:00
3ad51e6d6b Rewrite lesson to be self-contained and not depend on the core of WebGoat for fetching users
Split the assignment into 2 assignments
2021-11-16 16:32:43 +01:00
9e6ed11aa7 Remove link to lesson.css as they belong to the lesson 2021-11-16 16:32:43 +01:00
2bd6b36210 Fix layout assignment 2 2021-11-16 16:32:43 +01:00
bcaf4485c2 Move css to lesson itself 2021-11-16 16:32:43 +01:00
cd2e1c1c09 Fix spelling issues 2021-11-16 16:32:43 +01:00
22af35a9a7 Add favicon to WebGoat/WebWolf 2021-11-16 16:32:29 +01:00
c7e04cef97 Add logging to pom.xml 2021-11-16 16:24:45 +01:00
fa2769cb25 Updating poms 2021-11-16 16:24:45 +01:00
1a64fcd8d4 Recommit logging lesson as PR got a lot of conflicts 2021-11-16 16:24:45 +01:00
36bdd9b1a0 Rename master to main 2021-10-30 22:50:47 +02:00
6a875bdaa6 Add new developer 2021-10-28 21:21:34 +02:00
6a92f651f8 Move to Java 17 2021-10-28 21:19:05 +02:00
ad97e2c9a3 Remove activation dependency 2021-10-28 21:19:05 +02:00
e709a501cb Remove develop from branches to build
The PR already works on a merge commit with develop no need to build it once more afterwards
2021-10-24 13:12:48 +02:00
76af488d16 Move Github actions to same image as Docker run on 2021-10-24 13:08:52 +02:00
981fcb3ebc Move to different base image for Java
This way we can also support arm/v7
2021-10-24 13:08:40 +02:00
cc0d0fa2a6 Ignore branch builds on main repository 2021-10-24 11:51:47 +02:00
a4104fdf8b Ignore branch builds on our repository 2021-10-24 11:43:03 +02:00
720414eba6 Ignore branch builds on our repository 2021-10-24 11:40:13 +02:00
541c424eb9 Ignore branch builds on our repository 2021-10-24 11:36:35 +02:00
be2a6aa0bd Run only on branches 2021-10-24 11:25:15 +02:00
e5ab24a1fc Revert all GH actions work 2021-10-24 10:22:30 +02:00
b0174a6b26 Revert all GH actions work 2021-10-24 10:20:27 +02:00
cb8739ac06 Simplify Github actions 2021-10-24 10:16:52 +02:00
cb6c8af3bb Simplify Github actions 2021-10-24 10:03:47 +02:00
672d752e0e Simplify Github actions 2021-10-24 10:02:36 +02:00
8241d98a38 Simplify Github actions 2021-10-24 10:01:53 +02:00
86d3868d9e Simplify Github actions 2021-10-24 10:00:30 +02:00
2f007babec Simplify Github actions 2021-10-24 09:59:35 +02:00
7742444a99 Simplify Github actions 2021-10-24 09:58:28 +02:00
98bcef9a5e Simplify Github actions 2021-10-24 09:44:57 +02:00
c3f9772a27 Simplify Github actions 2021-10-24 09:39:37 +02:00
01d3453c41 Simplify Github actions
Consolidate build steps to 1 script this way we don't run multiple builds for pushing a branch and create a PR.
2021-10-24 09:30:00 +02:00
eb163c8df1 Remove unused badges 2021-10-16 19:38:04 +02:00
ff67ee6484 Update to correct version 2021-10-04 14:40:19 +02:00
ccdede647b Sign off
Signed-off-by: Jeroen Willemsen <jwillemsen@xebia.com>
2021-10-03 11:36:40 +02:00
4b32cc36a7 Remove sign off.
CLA assistant is structurally broken, let's keep it simple and not enforce signing off etc. There should be no barrier to get help from the community.
2021-10-03 11:35:50 +02:00
9e15e95001 Remove signoff action as it will not work with forked repositories 2021-10-02 17:49:42 +02:00
dc71975f27 No need to do mvn clean 2021-10-02 17:49:42 +02:00
b79a9c6b2c Build should use Java 16 2021-10-02 17:49:42 +02:00
a7b9954d0f 1101: fix quoting in statement 2021-10-02 17:39:26 +02:00
dfa0e1cdca XSS Lesson one boolean response
Signed-off-by: Àngel Ollé Blázquez <angel@olleb.com>
2021-10-02 01:09:52 +02:00
8e6d87d429 Remove unnecessary action 2021-09-30 18:53:27 +02:00
5adf1d1dd7 Renaming the actions 2021-09-30 17:11:08 +02:00
5164514789 Remove Slack integration from build as it needs a token and will never work when PR is received from a fork. 2021-09-30 17:09:21 +02:00
f28bb09724 Remove action 2021-09-30 16:54:52 +02:00
7602781a5b Bump actions/github-script from 0.3.0 to 5
Bumps [actions/github-script](https://github.com/actions/github-script) from 0.3.0 to 5.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/0.3.0...v5)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-09-30 11:46:52 +02:00
b6dff3f32b Update JDK references 2021-09-30 11:45:58 +02:00
360cdc7239 Fix broken link 2021-09-30 11:44:34 +02:00
74ca2ff12a Add signed commits to pull request template 2021-09-29 20:03:09 +02:00
fbf18440fb Revert "Use CLA again and add action to recheck it"
This reverts commit b7a1edd0
2021-09-29 20:02:42 +02:00
b7a1edd04a Use CLA again and add action to recheck it 2021-09-29 19:56:22 +02:00
14bb53d43a Add action to warn against PR against master (should be develop) 2021-09-29 19:00:29 +02:00
906ab766df Add action to warn against PR against master (should be develop) 2021-09-29 18:57:29 +02:00
902af04dd4 Add action to warn against PR against master (should be develop) 2021-09-29 18:45:00 +02:00
05bef55c80 Add action to warn against PR against master (should be develop) 2021-09-29 18:42:25 +02:00
5933d226af Add action to warn against PR against master (should be develop) 2021-09-29 18:31:19 +02:00
b7ff89243a Add action to warn against PR against master (should be develop) 2021-09-29 18:23:11 +02:00
835104c88f Add action to warn against PR against master (should be develop) 2021-09-29 18:21:33 +02:00
246b4de1b8 Add action to warn against PR against master (should be develop) 2021-09-29 18:20:08 +02:00
49109154a8 Add action to warn against PR against master (should be develop) 2021-09-29 18:12:22 +02:00
efca784acf Update sign off command
Signed-off-by: Jeroen Willemsen <jwillemsen@xebia.com>
2021-09-29 16:03:23 +02:00
14a6efedf3 Add extra documentation for using the correct algorithm but removing the signature. 2021-09-29 15:21:09 +02:00
ef4b7ce1a7 Fix link to signoff commits 2021-09-29 15:16:03 +02:00
68a69e9b07 Updated stale to only have those that require input from a user 2021-09-29 14:56:06 +02:00
93265a3686 Fix pr template 2021-09-29 14:56:06 +02:00
ae87f7eb49 Updated contributing 2021-09-29 14:56:06 +02:00
38bae09f82 First iteration of sign off testing 2021-09-29 14:56:06 +02:00
75b63ea179 first version of contributing and PR template 2021-09-29 14:56:06 +02:00
dd89e56f6e Start of contributing, adding lock and stale (as per example from Juiceshop 2021-09-29 14:56:06 +02:00
2cb9c52a7a Added code of conduct 2021-09-29 14:56:06 +02:00
e89a59b053 Added funding link 2021-09-29 14:56:06 +02:00
40456f25b9 Revert "Added funding link"
This reverts commit a1796f2577.
2021-09-29 14:02:38 +02:00
f5604df256 Revert "Added code of conduct"
This reverts commit 96ec4aa909.
2021-09-29 14:02:38 +02:00
32bd895632 Revert "Start of contributing, adding lock and stale (as per example from Juiceshop"
This reverts commit 897afa3c2b.
2021-09-29 14:02:38 +02:00
ffe400cb76 Remove accidentally added "test" addition 2021-09-29 14:01:57 +02:00
897afa3c2b Start of contributing, adding lock and stale (as per example from Juiceshop 2021-09-29 13:57:59 +02:00
96ec4aa909 Added code of conduct 2021-09-29 13:57:59 +02:00
a1796f2577 Added funding link 2021-09-29 13:57:59 +02:00
362248a065 Fix token signature validation 2021-09-29 13:51:17 +02:00
9403bbb851 Cleaned up pom, added simple quality test action on push usable for forks of the repo 2021-09-29 11:40:33 +02:00
0c285eef5b Merge pull request #1064 from WebGoat/1045
1045
2021-09-29 11:17:51 +02:00
1461263b60 Update WebGoat/GoatAndWolf version on the documentation to the latest 2021-09-26 14:02:49 +02:00
61f2bfa9ec Added jdk badge 2021-09-26 11:05:45 +02:00
04d1293a33 #1045: Run build with Java 16 2021-09-23 16:09:28 +02:00
9af514f3eb WebWolf DataSource Discovery 2021-09-23 15:57:48 +02:00
8e567b0f86 Spoofing an Authentication Cookie lesson 2021-09-23 15:51:17 +02:00
a4218b0016 Update start.sh
10 seconds is sometime to fast. WebWolf will fail to start if the database of WebGoat is not up.
2021-09-17 17:13:50 +02:00
42369816c9 1026 (#1047)
* Move back to Java 15 as XML parsers fail with XXE lesson

* Documentation improvement
2021-09-17 13:46:58 +02:00
3492655f1d Merge branch 'release/v8.2.2' into develop 2021-09-05 14:42:07 +02:00
7847e69574 Merge branch 'release/v8.2.2' 2021-09-05 14:41:58 +02:00
e75cfbeb11 Adding release notes for version 8.2.2 2021-09-05 14:41:28 +02:00
7ec6826abc #1031: Fix lesson
- Hints not shown
- Add more hints
- Incorrect grant statement in lesson as example (removed it)
2021-09-05 14:32:55 +02:00
825193bbb5 Update to latest lombok version 2021-09-05 14:32:55 +02:00
a14e84d5c5 #1039: Fix token
Replace `name` with `user` and add `admin`
2021-09-05 13:07:56 +02:00
14ab2faeaf Bump jsoup in /webgoat-lessons/cross-site-scripting
Bumps [jsoup](https://github.com/jhy/jsoup) from 1.13.1 to 1.14.2.
- [Release notes](https://github.com/jhy/jsoup/releases)
- [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES)
- [Commits](https://github.com/jhy/jsoup/compare/jsoup-1.13.1...jsoup-1.14.2)

---
updated-dependencies:
- dependency-name: org.jsoup:jsoup
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-09-04 16:28:15 +02:00
8e47eac263 Bump docker/build-push-action from 2.4.0 to 2.7.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 2.4.0 to 2.7.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/v2.4.0...v2.7.0)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-09-04 16:24:45 +02:00
6aaa743302 Fix vulnerable components lesson for Java 16. 2021-09-04 16:08:33 +02:00
0e08c4bde0 Update documentation related to Docker 2021-08-25 18:59:40 +02:00
f7871942da Add mapping for localhost:80 to nginx 2021-08-25 18:59:40 +02:00
c8fad66973 #1024: Update landing page 2021-08-22 18:26:58 +02:00
9cc0ae5c38 Add -it to Docker command so ctrl+c is working directly 2021-08-22 18:17:48 +02:00
9a37a27a3c Add explicit file encoding to the java command to prevent errors like: "It seems the application is startd on a OS with non default UTF-8 encoding:Cp1252"
"
2021-08-14 12:19:49 +02:00
453a09e0b4 Fix html 2021-08-14 12:19:49 +02:00
d566080a79 fix typo 2021-08-14 10:52:16 +02:00
4ce098f39b Pass options directly instead of setting env variables 2021-08-04 10:41:51 +03:00
f22e4f55c1 Update release notes 2021-08-04 10:15:38 +03:00
15ea31a4df Remove Travis badge and replace with Github actions 2021-08-02 18:46:01 +02:00
7881a70273 Merge branch 'release/v8.2.1' 2021-07-30 17:09:53 +03:00
032b90d483 Welcome message only when issue is opened 2021-07-30 13:23:10 +03:00
a050fa9669 Support multiple platforms 2021-07-29 11:26:17 +03:00
60bd04b9aa Move to snapshot version 2021-07-29 11:13:16 +03:00
91af9a0ef7 Merge branch 'release/v8.2.0' into develop 2021-07-26 13:03:16 +03:00
45c420ed05 Merge branch 'release/v8.2.0' 2021-07-26 13:02:21 +03:00
486b81f8ec Push image while releasing 2021-07-26 13:01:01 +03:00
eed0feed06 Merge branch 'release/v8.2.0' into develop 2021-05-25 20:56:38 +02:00
2c6c103f3b Merge branch 'release/v8.2.0' 2021-05-25 20:55:56 +02:00
e9df66ca1f Add release notes 2021-05-24 21:32:29 +02:00
1381daf06e Fix zip slip issue on Windows 2021-05-24 16:12:15 +02:00
ac542ad8b8 Also build on release branches 2021-05-23 21:28:49 +02:00
a2677cee58 Update to latest Maven version 2021-05-23 21:19:06 +02:00
a641a19615 Add zip slip to path traversal lesson 2021-05-23 21:18:56 +02:00
a91d45dea5 Fix other macros as well 2021-05-23 20:11:23 +02:00
81c551552b Fix layout issue image 2021-05-23 20:11:23 +02:00
69a370f438 New release, updating pom.xml 2021-05-23 20:11:23 +02:00
3aa791bc1b dependabot suggested updates (#1005) 2021-05-19 18:20:59 +02:00
a53ba0af5c Fix for accidentally disabled integration tests (#997)
* drop column is no longer required due to better db seperation
'

* integration test fix with BeforeAll
2021-05-19 18:20:31 +02:00
a1071e9c00 Fix return type of asciidoctor macro implementation. 2021-04-23 15:11:56 +02:00
70cda80176 Revert to older version of bootstrap, requires more work to get the layout working again
Especially the mailbox is not working in Bootstrap version 4
2021-04-23 10:21:19 +02:00
ac0cb3560c Fix merge conflicts for README 2021-04-22 20:58:05 +02:00
d9712e7589 Add distribution tag for Java action v2 2021-04-22 20:32:57 +02:00
cfe763f98d Bump actions/setup-java from v1 to v2
Bumps [actions/setup-java](https://github.com/actions/setup-java) from v1 to v2.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/v1...8764a52df183aa0ccea74521dfd9d506ffc7a19a)

Signed-off-by: dependabot[bot] <support@github.com>
2021-04-22 20:32:57 +02:00
4869616176 Simplify Docker image with regards to creating the webgoat user 2021-04-22 20:12:01 +02:00
30abcc0a1a Bump actions/cache from v2.1.4 to v2.1.5
Bumps [actions/cache](https://github.com/actions/cache) from v2.1.4 to v2.1.5.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](https://github.com/actions/cache/compare/v2.1.4...1a9e2138d905efd099035b49d8b7a3888c653ca8)

Signed-off-by: dependabot[bot] <support@github.com>
2021-04-16 13:33:37 +02:00
38f1d52bf3 Corrected typos and poor grammar found in the SQL Injection lessons. 2021-04-16 13:29:01 +02:00
e49f5d610f #961: Give each user its own schema for the lessons
This way we can reset a lesson using the database for each user and not for all users at once.
Also solves the issue that when someone solves the lesson it is solved for all users on the same WebGoat instance
2021-04-16 13:28:07 +02:00
04d065fd87 Update Dockerfile 2021-04-16 13:27:05 +02:00
d345a9a716 Remove obsolete Docker configuration 2021-04-16 13:27:05 +02:00
2d8d898fb7 Remove documentation about Docker compose and stack from README
Spring cleanup to make it a bit easier for users to only offer two options: Docker and stand alone version
2021-04-16 13:27:05 +02:00
ad9ee094b4 Remove all scripts
Part of the Travis build we use to have no longer needed as we moved to Github actions
2021-04-16 13:27:05 +02:00
cb2277628c Remove docker-compose files
They are old might work but we now have the all in one image which we actively maintain and release
2021-04-16 13:27:05 +02:00
5869b64ee0 Remove Vagrant image
It is old any never used we only update versions in this file
2021-04-16 13:27:05 +02:00
6ae9e44e84 Remove platform dependent deployments
They are part of the repository since 2017 they have never been updated and probably don't work anymore
2021-04-16 13:27:05 +02:00
d0f36f5227 Fix failing XXE test 2021-04-03 22:31:27 +02:00
5d45fd6260 Update Checkstyle version 2021-04-03 10:58:22 +02:00
b3f7a5338e Update to latest versions 2021-04-03 10:58:22 +02:00
b858484b97 Copy jar files to target so they are not stored in the current project directory 2021-04-03 10:58:22 +02:00
b76330f20f Add minimal Maven version 2021-04-03 10:58:22 +02:00
ee1d4b0ac1 Update documentation for Java 15 2021-04-03 10:58:08 +02:00
abf431fffb Remove unnecessary plugins in subprojects 2021-04-03 10:58:08 +02:00
3e8dbc9bc9 Run build on pull requests as well 2021-04-03 10:58:08 +02:00
721edc9985 Move WebGoat to Java 15 2021-04-03 10:58:08 +02:00
82198424df Corrected typos and poor grammar found in the SQL Injection lessons. 2021-04-02 21:31:11 +02:00
ba2cb7d14f #974: Update the lesson text 2021-04-02 07:31:19 +02:00
de453fad84 Fix issue with labels in SQL lessons 2021-04-01 17:48:32 +02:00
59c96f9890 Fix lesson it no marks it as solved if the user uses a different username 2021-03-31 19:32:47 +02:00
f7d3fd586e Remove the span added to the feedback 2021-03-31 19:32:47 +02:00
798afc756b Remove as it matches the normal success message 2021-03-31 19:32:47 +02:00
59aaab52a9 Disable testcase as it fails on Windows, needs investigation. 2021-03-31 19:31:13 +02:00
14621003d7 Remove banner.txt as you can set it with a property in application.properties 2021-03-31 19:31:13 +02:00
23f67b3d25 Remove unknown field which is set by reflection 2021-03-31 19:31:13 +02:00
1c6de07a54 Move integration test to JUnit 5 2021-03-31 19:31:13 +02:00
cda852f4e8 Run unit tests again for all lessons and rewrite all to JUnit 5
Due to the migration to Spring Boot 2.4 the Vintage dependency was no longer included by default, resulting in skipping all unit tests.
2021-03-31 19:31:13 +02:00
1d6a5ca01b Run unit tests again and rewrite all to JUnit 5
Due to the migration to Spring Boot 2.4 the Vintage dependency was no longer included by default, resulting in skipping all unit tests.
2021-03-31 19:31:13 +02:00
c574a6610b Make sure the release is behind approval 2021-03-31 19:31:13 +02:00
ae6d448aa0 Replace ${revision} with real version as Maven
The CI pipeline should take care of this.
2021-03-31 19:31:13 +02:00
b8bdb8f432 Updating to the new development version 2021-03-30 14:05:26 +00:00
3300c47c03 WIP 2021-03-30 16:03:57 +02:00
d077a76063 WIP 2021-03-30 16:02:06 +02:00
43d13dd1f9 WIP 2021-03-30 16:01:05 +02:00
072d99040f WIP 2021-03-30 15:55:18 +02:00
4d5968da1a WIP 2021-03-30 15:54:04 +02:00
5a3843cf1f WIP 2021-03-30 12:36:48 +02:00
5fd0f03fd4 WIP 2021-03-30 11:12:41 +02:00
1cd115ace5 Bump actions/cache from v2 to v2.1.4
Bumps [actions/cache](https://github.com/actions/cache) from v2 to v2.1.4.
- [Release notes](https://github.com/actions/cache/releases)
- [Commits](https://github.com/actions/cache/compare/v2...26968a09c0ea4f3e233fdddbafd1166051a095f6)

Signed-off-by: dependabot[bot] <support@github.com>
2021-03-29 12:12:05 +02:00
a9f8ff1090 Use 8.2.0 instead of v8.2.0 2021-03-29 09:30:51 +02:00
e114360a5f Fix SQL Injection 2021-03-29 08:28:36 +02:00
b16e60f691 Move OWASP dependency check to a Maven profile
This takes way too long to perform each time on a Github action as we cannot cache the image
2021-03-29 08:27:17 +02:00
f959e0387e Update Guava dep 2021-03-29 08:27:17 +02:00
425eb03a6e Remove docs dir and only keep the redirect to the OWASP website 2021-03-29 08:27:17 +02:00
8e312204ee Update to latest version and move the plugins out of the profile section.
Move the configuration files from parent dir to config dir
2021-03-29 08:27:17 +02:00
2e733f8594 Fix failing test on Windows
This was found because we migrated to Github actions which causes this test to fail because it uses "\n"
2021-03-29 07:43:07 +02:00
4e308d7880 Fix automatic rebase command 2021-03-29 07:30:03 +02:00
935871c39a Add some debugging information to know which test cases might have failed 2021-03-29 07:30:03 +02:00
ce6e4d2090 Fix issue with looking for all directories one present should be enough 2021-03-29 07:30:03 +02:00
68a53bc5dc Fix failing test Windows it fails with a much lower number 2021-03-29 07:30:03 +02:00
459d9ad74c Move away from Travis to Github actions 2021-03-29 07:30:03 +02:00
e40a26f193 Improve token handling 2021-03-15 17:48:13 +01:00
59e04dee6e Fix typo 2021-03-15 17:48:13 +01:00
5a16ea514a Fix quiz 2021-03-15 17:48:13 +01:00
8d2d82764f Assignment 8 loads JWT key again 2021-03-15 17:48:13 +01:00
dedb2f9fef Open new tab when clicking on JWT link for WebWolf 2021-03-15 17:48:13 +01:00
8b89667d9d Fix quiz, first should be second 2021-03-15 17:48:13 +01:00
d4da2d0efa Convert lesson into using DB instead of using regular expression to check the solution 2021-03-15 17:48:13 +01:00
c798e4be32 Fix JWT integration tests 2021-03-15 17:48:13 +01:00
1ebd50cb5b WIP 2021-03-15 17:48:13 +01:00
f2ab5c1968 Update JWT lesson 2021-03-15 17:48:13 +01:00
ead1d6fffb Bootstrap requires jQuery 2021-03-15 17:48:13 +01:00
9b81cb44fa Bootstrap loads now, otherwise dropdown etc does not work 2021-03-15 17:48:13 +01:00
142631c7a0 WIP 2021-03-15 17:48:13 +01:00
e78549fb72 Add JWT encoder to WebWolf 2021-03-15 17:48:13 +01:00
431da30946 Selenium test added (#906)
* add a selenium test for firefox

* add geckodriver and firefox to travis

* install updated

* install updated

* try out suggested webdriver dependency class

* add more resilience
2021-02-21 19:57:08 +01:00
ad5ab4ca2e Fixes #321 (#935)
Copyright year was "20014", replaced to "2014"
Fixed the old github.io URL which no longer exist
See https://github.com/WebGoat/WebGoat/issues/321
2021-02-18 19:06:11 +01:00
522f6b5fff Fixed a typo (#936)
Fixed a typo in the documentation and added a colon for better readability
2021-02-18 19:04:00 +01:00
c6789d7ce3 Update Apache Maven from 3.2.1 to 3.2.5 (#932)
The version of Maven is not compatible with the plugin "org.codehaus.mojo:flatten-maven-plugin:1.2.5" used in webgoat-container
```
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Using 'UTF-8' encoding to copy filtered properties files.
[INFO] Copying 1 resource
[INFO] Copying 111 resources
[INFO] The encoding used to copy filtered properties files have not been set. This means that the same encoding will be used to copy filtered properties files as when copying other filtered resources. This might not be what you want! Run your build with --debug to see which files might be affected. Read more at https://maven.apache.org/plugins/maven-resources-plugin/examples/filtering-properties-files.html
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO] 
[INFO] webgoat-container ................................. FAILURE [ 18.319 s]
...
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 26.001 s
[INFO] Finished at: 2021-02-06T09:37:58+00:00
[INFO] Final Memory: 49M/162M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.codehaus.mojo:flatten-maven-plugin:1.2.5:flatten (flatten) on project webgoat-container: The plugin org.codehaus.mojo:flatten-maven-plugin:1.2.5 requires Maven version 3.2.5 -> [Help 1]
```
2021-02-11 15:14:50 +01:00
215b3b4e78 Remove redundant escaping in regex (#929) 2021-02-11 15:13:38 +01:00
00c4be63f0 Fix sql injection line comments issue. (#925) 2021-01-19 10:47:04 +01:00
2e581d6bdb docs: update SQLi lesson text (#928)
- corrected typos/grammar issues
  - restructured sentences for clarity
2021-01-19 10:29:16 +01:00
b20f6492a3 Simplify regex (#927) 2021-01-15 14:36:04 +01:00
74b218b2a7 Use try with resources instead of try (#921)
* Use try with resources instead of try

* Remove unused lesson

* Remove unused fields
2021-01-13 18:21:04 +01:00
b219854f81 fix in case external site is down (#919) 2021-01-11 20:15:23 +01:00
dea4a9d2a9 Small improvements (#918)
* Typo fix

* No need to use thread-safe object

* Use String case in-sensitive equals
2021-01-11 16:38:14 +01:00
6d3f38e2df Update README.MD (#915) 2021-01-11 15:56:50 +01:00
60c7fdd0db activation button tested 2020-12-09 19:40:16 +01:00
bce4c775bf initial idea for explanation on static code analysis and experience of the fix 2020-12-09 19:40:16 +01:00
8bed91a8dc improved threading and logic based on number of calls and number of tests (#910) 2020-12-08 16:03:36 +01:00
e78420fa8e fix warnings 2020-12-04 08:47:50 +01:00
f676b3a3d6 fix warnings 2020-12-04 08:47:50 +01:00
8b4240889a fix warnings 2020-12-04 08:47:50 +01:00
262afedb08 fix warnings 2020-12-04 08:47:50 +01:00
9dbd41c830 fix warnings 2020-12-04 08:47:50 +01:00
3aab59e326 fix warnings 2020-12-04 08:47:50 +01:00
0f7a556b9c fix warnings 2020-12-04 08:47:50 +01:00
48b3c6a07d fix warnings 2020-12-04 08:47:50 +01:00
649fce6f42 fix warnings 2020-12-04 08:47:50 +01:00
b1495a8cd5 Fix typo (#909) 2020-12-03 14:23:23 +01:00
69c19d19d4 flattened pom plugin added for easy build of seperate modules (#907) 2020-12-01 17:12:43 +01:00
89f43229ab upgrade springboot version and some related unit test fixes (#904)
* upgrade springboot version and some related unit test fixes

* removed log for test

* removed junit version property
2020-11-28 17:35:55 +01:00
8235ea0f58 Custom menu (#901)
* added way to customize menu

* fixed unit mock test

* updated release notes

* updated release notes

* default none exclude
2020-11-27 14:36:57 +01:00
6bee0f3fa6 layout of page improved and ordered ranking (#903) 2020-11-27 13:58:58 +01:00
574039902d changed version to snapshot version and introduced revision parameter
for it
2020-11-27 12:15:19 +01:00
090263b279 added start checks with hints on port usage 2020-11-27 12:13:24 +01:00
74cca6d185 Add missing trailing double quote in sql query (#897) 2020-11-19 07:45:07 +01:00
f3e3cbd45f Improve navigation bar (#890)
* Remove Raspberry pi Docker file

* Remove old show-source/solution and plan button

* Remove commented out code

* Improve navigation

* Remove underline from navigation and remove margin of left navigation button

* Make arrow a bit smaller so it aligns a bit better with the navigation bar itself
2020-11-13 07:24:52 +01:00
db3015e0bc When current lesson is not set do not try to remove selected class as there is no element selected.
The current lesson is now selected correctly so it makes it easier to see which item in the menu is selected
2020-11-04 21:33:57 +01:00
fa9b5ae87d Remove option to hide menu with the lessons 2020-11-04 21:33:57 +01:00
36cf028334 Remove blinking navigation buttons 2020-11-04 21:33:57 +01:00
488a8e934a #843: Add readonly field and update the layout of the assignment 2020-11-04 20:35:05 +01:00
753a2db958 #846: add extra test to verify whether the solution is solved for the original user as well 2020-11-04 20:35:05 +01:00
37e9359c9e #841: Clarify the lesson based on the comments
- Output messages more clear
- Replace success to failure (otherwise lesson is marked complete immediately)
- Fix the layout of the lesson (remove whitespace update buttons)
2020-11-04 20:35:05 +01:00
7b8523dcab #839: fix the SQL statement as this one does not express that the orderBy clause input is user input 2020-11-04 20:35:05 +01:00
dac011db78 fix failing test (order) 2020-10-21 08:05:53 +02:00
41879c4603 Blind XXE lesson blocks including the file in the comment directly 2020-10-20 22:09:49 +02:00
641d75e734 Link to the original lesson for the goal 2020-10-20 22:09:49 +02:00
e4ec90db8a chore: update CIA grammar and content
- misc. grammatical edits
  - add a few more examples
2020-10-15 08:39:28 +02:00
d5f78351a2 lesson pages updated based on comments for #834 and #836 (#864) 2020-08-23 15:36:01 +02:00
ef6993c636 improving lesson due to issue #845 2020-07-09 19:21:42 +02:00
2d2dc22e19 first step 2020-07-09 19:21:42 +02:00
db9e1c4c4f first step 2020-07-09 19:21:42 +02:00
317573c897 Small fixes june 2020 (#857)
* issue 849

* another integration test for a challenge

* fixing issue 848

* updated link for issue 833

* fix for 847
2020-07-08 19:26:09 +02:00
ba8444dd85 Update 1proxysetupsteps.adoc (#854)
thanks for the fix
2020-07-04 08:00:32 +02:00
219aad0bbc Correcting incorrect information (#835)
Thanks for the improvement. Hope you liked the lesson.
2020-06-19 17:00:43 +02:00
1cbaade9ab adjustments for arbitrary user support (openshift guideline) (#830)
* adjustments for arbitrary user support (openshift guideline)

* do not create up front .webgoat
2020-06-08 07:30:55 +02:00
98d17433f1 HTML Tampering mitigation: Typo fixes 2020-05-25 09:09:26 +02:00
11a7814626 Dinis Cruz Blog
This was discussed in ticket https://github.com/WebGoat/WebGoat/issues/724 however the Dinis Cruz Blog remains available through a blogspot.com URL which might be more interesting to reference than an web.archive.org link.
2020-05-25 09:08:55 +02:00
5311db8564 XSS Quiz: Fix 404
The original URL was malformed because it contained a closing ) which did not end up in the link. However the corrected link performs a redirect to the link provided in this patch.
2020-05-25 09:08:09 +02:00
ae156a4a0f Function AC User: Spelling and grammar fixes. 2020-05-25 09:07:31 +02:00
9576c6b9da Function AC Lesson 1: Spelling and grammar fixes. 2020-05-25 09:07:31 +02:00
6c83457231 Function ac intro: Spelling and grammar update 2020-05-25 09:07:31 +02:00
060851a4a2 IDOR_intro.adoc: Fix 404
The closing ')' in the URL was not taken up in the link causing a 404 when clicking the URL.
2020-05-24 09:57:29 +02:00
671691a5ed XXE_changing_content_type.adoc: Typo fixes 2020-05-24 09:56:43 +02:00
f326755190 XXE_intro.adoc: Typo fixes 2020-05-24 09:56:43 +02:00
99edda6029 XXE_plan.adoc: Typo fixes 2020-05-24 09:56:43 +02:00
717f852680 InsecureLogin_intro.adoc: Typo fix 2020-05-24 09:56:43 +02:00
c42d6b15c3 SecurePasswordsAssignment: Fix output formatting
- When solving the solution (entering a correct password) then the 'Score: 4/4' does not start on a new line, instead it is glue to the Estimated cracking time line. As a solution the </br> is added as a suffix on that line (and successive lines).
- Maximum score is 4, not 5 (see also the assignment, and https://github.com/nulab/zxcvbn4j/blob/master/src/main/java/com/nulabinc/zxcvbn/TimeEstimates.java#L23 which is the origin of getScore() )
2020-05-24 09:56:01 +02:00
dfa3242aeb Delete unused PasswordReset_password_reset_link.adoc
Not referenced in webgoat-lessons/password-reset/src/main/resources/html/PasswordReset.html, looks like a placeholder/dead code.
2020-05-24 09:39:18 +02:00
23762885fa PasswordReset_host_header.adoc: Typo fixes 2020-05-24 09:39:18 +02:00
60087e441d PasswordReset_SecurityQuestions.adoc: Typo fix. 2020-05-24 09:39:18 +02:00
2e8d0dd9b5 PasswordReset_plan.adoc: Spelling fixes 2020-05-24 09:38:25 +02:00
966d7a7aed JWT_refresh.adoc: Fix spelling issues 2020-05-24 09:37:47 +02:00
851fd9ae03 Only push to 1 Docker repo 2020-05-23 17:01:13 +02:00
637d393889 Update README.MD 2020-05-23 16:40:54 +02:00
2dad97bdcb Docker command without -d option to show output int console 2020-05-23 16:39:37 +02:00
c0ce72a2bd Remove Github pages, too many things to keep in sync.
Let's keep the focus on the OWASP page and the Github README
2020-05-23 16:35:32 +02:00
90ea59cfca Remove Github pages, too many things to keep in sync.
Let's keep the focus on the OWASP page and the Github README
2020-05-23 16:30:42 +02:00
c695614fac Fix Docker link 2020-05-23 16:30:42 +02:00
304312018b Update README.MD 2020-05-23 16:22:23 +02:00
3a2bfc9c24 Cleanup readme 2020-05-23 16:19:22 +02:00
3d0f879c12 Remove dep status 2020-05-23 16:17:16 +02:00
a4f7059051 Merge branch 'release/v8.1.0' 2020-05-23 14:19:03 +02:00
61720b29ea Fix Travis script 2020-05-23 13:40:28 +02:00
75700597e6 Merge branch 'release/v8.1.0' into develop 2020-05-22 15:09:11 +02:00
bd16fedb33 Merge branch 'release/v8.1.0' 2020-05-22 15:08:50 +02:00
39740e069e New release 2020-05-22 14:10:31 +02:00
5739705d8a Process review comments 2020-05-22 10:10:42 +02:00
9b72610510 Extend XXE lesson with more content and add solution description
Remove obsolete images
Add stylesheet items specific for asciidoctor so we can for icons and source numbering
2020-05-22 10:10:42 +02:00
c4a046bd12 Ch1 less default (#814)
* random pincode in challenge1

* unit test fix
2020-05-12 08:49:48 +02:00
f520c3589c flag submission fixed (#812) 2020-05-07 11:04:00 +02:00
832d6432fc fix for JWT green button and WebWolf intro green button and added jwt int tests (#808) 2020-05-07 08:28:45 +02:00
f4838e1233 add int test for acl 2020-05-01 09:15:29 +02:00
70771ee854 added a webwolf template error page with some explanation and updated 2017 to 2020 2020-04-30 10:21:53 +02:00
9dea696c4c added int test for IDOR and fixed green button issue (#801) 2020-04-29 12:12:11 +02:00
2398949396 added ace js for java 2020-04-28 09:33:54 +02:00
57c008a697 Fix reading file, added try/catch and added tests 2020-04-28 09:25:39 +02:00
2614044918 Fix copying of pictures to WebGoat home directory 2020-04-27 13:07:23 +02:00
1aad57ba55 Fix the syntax differences between HSQL and Postgres 2020-04-27 11:45:41 +02:00
54610868fe Fix the syntax differences between HSQL and Postgres 2020-04-27 11:45:41 +02:00
4831338649 Remove explicit HSQLDB property from WebGoat and use the Spring Boot version 2020-04-27 11:45:41 +02:00
3bb7ee46bd Upgrade to Postgres 10 2020-04-27 11:45:41 +02:00
1a9ce15e99 fix typo (hint3 will not be shown) 2020-04-27 10:44:39 +02:00
9063b4137f fix 404 links 2020-04-27 10:44:39 +02:00
d7ae3a4391 fix typo 2020-04-27 10:44:39 +02:00
db66c1dd02 fix number of steps 2020-04-27 10:44:39 +02:00
608728b135 fix asciidoc italic format 2020-04-27 10:44:39 +02:00
88eb4d7b26 ace editor added without all the nonsense around it 2020-04-26 16:45:56 +02:00
58bc94d1f6 fix green buttons 2020-04-22 16:37:00 +02:00
6f532683a1 lessonplan character updates so it also works on Windows Cp125 2020-04-20 12:54:18 +02:00
6b68a12449 Set more conditions for releasing 2020-04-19 15:42:50 +02:00
27bf08ad5c Deploy and release on Java 11 2020-04-19 15:42:50 +02:00
52b66ed506 Java 12 is EOL so no need to support it 2020-04-19 15:42:50 +02:00
a5350060e1 Add dummy extra method with return type AttackResult because every assignment needs at least one such mapping (in the challenges case this is optional but since the challenges are an extra thing and this is the only assignment which has no such method adding a dummy method makes sense) 2020-04-19 15:42:50 +02:00
4f649234a9 Fix Java 11 issue where the order of methods returned in AssignmentEndpoint subclasses returned wrong method for determining the mapping of an assignment. Now we walk over all methods until we find one which has for example a @GetMapping with AttackResult or ResponseEntity<AttackResult as return type. If no such method is found an exception is thrown 2020-04-19 15:42:50 +02:00
96412da04e Remove unused imports and parameters 2020-04-19 15:42:50 +02:00
0015394582 Fix typo 2020-04-19 15:42:50 +02:00
9cb63a7c43 Update to latest surefire plugin otherwise new JUnit 5 test fails 2020-04-19 15:42:50 +02:00
561fb1f7f4 Build matrix for building 2020-04-19 15:42:50 +02:00
3b7481c2a7 Update method signature 2020-04-19 15:42:50 +02:00
f1768bd9a5 small update 2020-04-19 15:42:50 +02:00
407e19638f Add two more assignments for SQL injection where only filtering is applied. 2020-04-19 15:42:50 +02:00
122cc323f2 Changed the order of explanation of setting up ZAP/Burp a bit (feedback from workshop). This makes the necessary steps more explicit by moving all extra configuration for https etc to the back. So when you follow the lesson you will only setup the minimal and not get confused about things which are only necessary in certain cases 2020-04-19 15:42:50 +02:00
9509993a8f all tests complete for Password Reset (#785) 2020-04-17 15:54:24 +02:00
25e66ae412 use of script console in stead of browser address bar 2020-04-17 15:33:26 +02:00
089952e9ad quiz fix for CIA, SQL Injection Advanced and XSS + XSS description
change in alert(document.cookie)
2020-04-17 15:33:26 +02:00
efc5a870a0 Path traversal windows unittest fix (#780)
* fixes to support windows and linux/unix/mac

* fix in matcher
2020-04-14 16:13:43 +02:00
0638cae6e5 corrected hints and improved error handling base64 (#781) 2020-04-14 16:13:25 +02:00
b8abc99faf fix for scoreboard after js refactoring 2020-04-08 12:05:01 +02:00
e921fb66a9 actual working version of vulnerable components part 5 2020-04-08 12:05:01 +02:00
e25f7a7560 clean up and update js 2020-04-08 12:05:01 +02:00
c4ae9ae2ab migrate to JUnit 5 code 2020-04-06 16:02:15 +02:00
c4153ecbfb Maven owasp dep update (#776)
* add pmd and owasp dependency check through -P owasp profile

* suppress full stack trace in log

* revert to spring 2.2.0 as 2.2.4 failed in travis

* added owasp dependency check maven configuration details to vulenerable
lesson page 7
2020-04-06 16:01:09 +02:00
bb6d06713f Fix failing test 2020-03-10 08:03:48 +01:00
14022d88c9 Last assignment now filters out .. and / so encoding plays a role now 2020-03-10 08:03:48 +01:00
d4966b5e71 Fix test cases 2020-03-10 08:03:48 +01:00
b3840e60e3 Fix lessons 2020-03-10 08:03:48 +01:00
3ece45b3d4 Fix for not passing the content-type 2020-03-10 08:03:48 +01:00
6b7678fb1d Remove old files 2020-03-10 08:03:48 +01:00
6c25cf8e43 Add path traversal lesson 2020-03-10 08:03:48 +01:00
c4c28f544f Fixed CSRF broken links. 2020-03-06 17:15:10 +01:00
3b050a856a tested solution with unit test and verfied with lesson 5 on ie 2020-02-28 23:11:29 +01:00
71d9c4b61a first steps 2020-02-28 23:11:29 +01:00
a8118a14cd add support for status 403 feedback from e.g. ModSecurity/CRS 2020-02-28 23:06:42 +01:00
5f3dff4921 added notes on salted hash (#758) 2020-02-27 07:20:58 +01:00
208aa42fdb relax detection regex (#757)
Allow for content before and after the script; Allow optional semicolon
2020-02-20 20:00:07 +01:00
cd3fb8040f Typo and grammar corrections for the crypto lessons (#756)
* Correct typos and grammar errors.

* Revert one grammar change
2020-02-09 08:00:08 +01:00
9d5fa6f4ef Correct typos and clarify language in signing.adoc (#754)
Some of the changes correct simple misspellings. Some are intended to clarify or simplify the language.
2020-01-30 14:01:42 +01:00
6797033a09 restored pom removal (#753) 2020-01-25 18:18:06 +01:00
9eee726eb5 All in one docker (#749)
* all-in-one Dockerfile preparations

* some cleanup

* add to main pom and add links in index.html

* updated deploy script from build pipeline

* additional line feed just in case
2020-01-25 17:54:24 +01:00
4e371b63d0 suppressing some useless log messages and banners in unit tests (#752)
* suppressing some useless log messages and banners in unit tests

* some more log suppressed
2020-01-25 12:11:45 +01:00
edd6b7d7cf Reset lesson bug (#741)
* Remove old code from UI

* Remove old code

* Remove old functions

* Remove unnecessary divs

* Remove logging to console

* Clear lesson messages (checkmark, output text etc) when lesson resets
2020-01-05 20:22:50 +01:00
5de82c0a06 Fix link to XStream blog which no longer exists (#740) 2020-01-05 19:48:40 +01:00
71f2d2968f Fix NPE when request does not contain parameter (#739) 2020-01-05 15:14:53 +01:00
0d7daf60d9 Fix broken e-mail link (#738) 2020-01-05 15:05:51 +01:00
bb80e11665 dockerfile and compose changes (#737)
* dockerfile and compose changes

* adjusted link
2019-12-27 20:32:35 +01:00
8088465652 Move and remove unneccessary pom dependencies (#736) 2019-12-24 16:14:36 +01:00
035c8662d4 Revert "Bump xstream from 1.4.5 to 1.4.6 in /webgoat-lessons"
This reverts commit a831d949b2.
2019-12-23 17:14:20 +01:00
a831d949b2 Bump xstream from 1.4.5 to 1.4.6 in /webgoat-lessons
Bumps xstream from 1.4.5 to 1.4.6.

Signed-off-by: dependabot[bot] <support@github.com>
2019-12-23 17:12:31 +01:00
4c45a1e68c This lesson is intended to show the dangers of outdated software. However in version 1.4.7 the vulnerability is fixed! In 1.4.5 it is still present, so I suggest this downgrade. It is tested and works as intended, just as 1.4.7 does not. 2019-12-23 17:09:46 +01:00
f79ad452d2 password reset support for using www.webwolf.local 2019-12-23 17:08:33 +01:00
59076fc9ef adjusted WebWolfMacro 2019-12-23 17:08:33 +01:00
b6aa677594 Zap 8 update for proxy lesson (#718)
* additional steps in proxy setup added

* lessons checked

* added page on https proxy and burp proxy
2019-12-10 12:14:21 +01:00
681a20a7c3 In the migration to Spring 2, this method lost its get mapping to the IDOR/profile url,breaking the javascript call to that address. (#720)
thanks!
2019-12-04 12:21:19 +01:00
c5ec2d40a1 updates docker image name (#717) 2019-11-26 18:12:06 +01:00
b5e5dd1d13 Crypto lesson (#712)
* crypto lesson added

* signing assignment

* integration test added for signing assignment

* added more hints

* corrections after rebase

* added some explanation

* added security defaults assignment
2019-11-23 21:52:14 +01:00
9c0b7f8233 Fix version substitution so WebGot home directory contains version number instead of @project.version@ in the name (#710) 2019-11-17 14:33:24 +01:00
5dd6b31905 Adjust lesson template (#704)
* Remove method `getId()` from all lessons as it defaults to the class name

* remove clean up endpoint

* remove unused class `RequestParameter`

* remove unused class `PluginLoadingFailure`

* Move `CourseConfiguration` to lesson package

* Add more content around the lesson template lesson and make it visible as a lesson in WebGoat

* Remove explicit invocation `trackProgress()` inside WebGoat framework so assignments only need to return an `AttackResult`

* Put original solution back as well for SQL string injection

* review comments

* Add
2019-11-17 13:39:56 +01:00
f40b6ffd31 Moving back to snapshot 2019-11-13 12:27:26 +01:00
7313fc6c08 Merge branch 'release/v8.0.0.M26' into develop 2019-11-12 09:33:05 +01:00
c8ac054093 Merge branch 'release/v8.0.0.M26' 2019-11-12 09:32:50 +01:00
fe2ac1b8d4 New release, updating pom.xml 2019-11-12 09:22:45 +01:00
ba74898441 Add JavaScript to assignment otherwise you will not be able to see the flow of the endpoint 2019-11-12 09:12:37 +01:00
1d477bd0e8 Rename endpoint in JavaScript as backend call uses different endpoint 2019-11-12 09:12:37 +01:00
48b604d6d9 Enable salaries again as rest controller 2019-11-12 09:12:37 +01:00
2ab8a838c3 update JRE and milestone version to latest 2019-11-11 22:03:20 +01:00
e07a2aff48 Fix mistake the SQL exception should be throws otherwise users cannot see the table name (servers) makes it impossible to
solve the assignment. Add explicit test for this to guard against future mistakes
2019-11-11 21:17:51 +01:00
7d48427d4f Integrate ZAP 2.8.0 (no HUB) as the setup is different also update the filtering as usual ZAP exclusion is again broken 2019-11-11 21:17:51 +01:00
d8844216cc Add solution for Firefox no longer proxying localhost at all 2019-11-11 10:38:25 +01:00
ab3cd118c9 Explicitly set Maven repo to https 2019-11-11 10:38:05 +01:00
8da4342430 Improve readability of query (#685)
thanks! and do not forget to clean your .webgoat... local db related files
2019-11-04 13:28:35 +01:00
ddf6ac9bdb Improve handling of missing parameters, now returns HTTP/401 (#698) 2019-11-03 18:27:03 +01:00
f7b794bf68 Race condition in counting number of attempts #567 (#697)
Add version to Hibernate mapping so we get optimistic locking this solves
number of parallel calls trying to update/guess and mess with the lesson
counter
2019-11-03 18:14:15 +01:00
1a83e2825e Code style (#696)
* Remove Guava dependency from WebGoat

* Add Checkstyle to the project with very basic standards so we have a
style across lessons. It does not interfere with basic Intellij formatting
2019-11-03 18:11:09 +01:00
66bd1d8c1a Remove obsolete methods
As there were removed also in e8d086ac9b (diff-98a46e7f04c7a2dd03d59046076aac5bL40)
2019-10-30 08:28:42 +01:00
531db87876 Fix CommandInjection java files
Avoid these compilation errors:

```
[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR :
[INFO] -------------------------------------------------------------
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjectionExecute.java:[47,8] class HttpBasicsInterceptRequest is public, should be declared in a file named HttpBasicsInterceptRequest.java
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[38,8] class HttpProxies is public, should be declared in a file named HttpProxies.java
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[5,33] cannot find symbol
  symbol:   class AbstractLesson
  location: package org.owasp.webgoat.lessons
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[38,34] cannot find symbol
  symbol: class AbstractLesson
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[39,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[44,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[49,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[54,5] method does not override or implement a method from a supertype
[ERROR] /tmp/app/webgoat-lessons/command-injection/src/main/java/org/owasp/webgoat/plugin/CommandInjection.java:[59,5] method does not override or implement a method from a supertype
[INFO] 9 errors
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  4.356 s
[INFO] Finished at: 2019-10-19T21:13:03Z
[INFO] ------------------------------------------------------------------------
```
2019-10-30 08:28:42 +01:00
cac5985873 Fix command-injection pom.xml 2019-10-30 08:28:42 +01:00
c03b8e22bf Fix webgoat-lesson-template parent artifact ref
WebGoat 8 latest ([develop](9fdbbf69d6)) has the following compilation error:

```
Building Maven project at /builds/gitlab-org/security-products/tests/webgoat/webgoat-lessons/webgoat-lesson-template.
[INFO] Scanning for projects...
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[FATAL] Non-resolvable parent POM for org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version]: Could not find artifact org.owasp.webgoat.lesson:webgoat-lessons-parent:pom:8.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 6, column 13
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version] (/builds/gitlab-org/security-products/tests/webgoat/webgoat-lessons/webgoat-lesson-template/pom.xml) has 1 error
[ERROR]     Non-resolvable parent POM for org.owasp.webgoat.lesson:webgoat-lesson-template:[unknown-version]: Could not find artifact org.owasp.webgoat.lesson:webgoat-lessons-parent:pom:8.0-SNAPSHOT and 'parent.relativePath' points at wrong local POM @ line 6, column 13 -> [Help 2]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
[ERROR] [Help 2] http://cwiki.apache.org/confluence/display/MAVEN/UnresolvableModelException
Error: Project couldn't be built: exit status 1
```

This is due to an invalid (obsolete) ref in the parent artifact.

Full logs: https://gitlab.com/gitlab-org/security-products/tests/webgoat/-/jobs/322887707
2019-10-30 08:28:42 +01:00
710adfae20 Upgrade to latest Spring Boot version 2019-10-30 08:28:14 +01:00
9b87fd602c Explicitly set session persistence to false (result in non serializable exception) 2019-10-30 08:28:14 +01:00
28299f3ced Bind HSQLDB to same address as WebGoat 2019-10-30 08:28:14 +01:00
689e3de7a4 Final changes for splitting SQL WebGoat and lessons 2019-10-30 08:28:14 +01:00
25dae3a4a8 Fix merge request 2019-10-30 08:28:14 +01:00
d73875e8e8 Remove empty line 2019-10-30 08:28:14 +01:00
e783c0c1f1 SQL: Cannot use apostrophe/quotes on string literals #662 2019-10-30 08:28:14 +01:00
2a6b3d189e Disable csrf through property no longer works and we already have it in WebSecurityConfig. Thymeleaf templates caching is set on the resolvers themselves 2019-10-30 08:28:14 +01:00
96d11697d4 SQL Injection lesson 6 minor mistakes in examples #663 2019-10-30 08:28:14 +01:00
a0933d83d5 Reworked all the SQL statements to be uppercase 2019-10-30 08:28:14 +01:00
9fdbbf69d6 Proposition for fixing broken/improving links (#686)
* As stated on enzoic.com: "PasswordPing is now Enzoic!"

* Add references to other OWASP resources
2019-10-16 17:29:27 +02:00
1f00d461a8 cleaned logs and changed username length for csrf-uuid 2019-10-15 13:59:18 +02:00
6dc679e7b8 final tests and fixed the issue of getting the name of the loggedinuser 2019-10-15 13:59:18 +02:00
00873cfe3f csrf7 test cases added 2019-10-15 13:59:18 +02:00
e932253f06 initial test cases added 2019-10-15 13:59:18 +02:00
8d7142e6d3 upgrade ascii doc with support for link in new tab 2019-10-15 13:55:34 +02:00
e0ac4a1083 lessons in correct order and scoreboard visible again (#680) 2019-10-10 09:45:43 +02:00
f140875156 fixed views for password reset (#679) 2019-10-10 07:50:47 +02:00
18d43f16d3 working version with fixed link and GET for tracing purposes (#677)
* working version with fixed link and GET for tracing purposes

* added integration test

* filter on request log
2019-10-09 09:58:35 +02:00
aee4b74202 Update Receiving_mail.adoc (#676) 2019-10-03 18:22:54 +02:00
b481ed70e8 Fix typo in SQL Injection(Introduction) (#675)
Fix typo `date` to `data` which seems more appropriate in context.
2019-10-03 10:01:35 +02:00
fd7fb4cfbc seems that we forgot about this one in the spring-boot-2 upgrade (#674) 2019-10-02 14:52:21 +02:00
663224d06a xxe path info (#670)
* xxe path info aid added

* xxe path info aid added

*  changes to template file and hints

* added ssl test support for XXE

* added ssl test support for XXE

* restconfig replaced by httpsrelaxed

* processed review comments on hints and example
2019-10-02 09:59:32 +02:00
7536770769 deserialization made solvable again (#673)
* first objects and unit tests for making a fix for the lesson

* example added

* unit test for windows and linux

* added unit tests hints and feedbacks and updated lesson pages

* small typo correction
2019-10-02 08:26:48 +02:00
6c14f4987c Update IntroductionWebWolf.adoc
use aangepast in gebruiker
2019-10-02 07:55:57 +02:00
3d38ed7680 some text change 2019-10-02 07:55:57 +02:00
1a11702979 NL intro 2019-10-02 07:55:57 +02:00
0319c477b1 XSS lesson completion fixes (#669)
* XSS lesson completion fixes

* removed log all

* lesson progress capable of deprecated assignments in the database

* fixed unit test for lesson progress
2019-09-29 14:46:18 +02:00
45c7949118 Merge pull request #668 from afcidk/fix-typo
thanks for the fix
2019-09-27 15:05:59 +02:00
9b906a2a29 Fix typo in XXE lesson 2019-09-25 00:37:36 +08:00
686d8b0c85 Merge pull request #667 from WebGoat/spring-boot-2
Spring boot 2
2019-09-24 17:09:09 +02:00
d080b3ef06 Review comment 2019-09-24 07:36:49 +02:00
dad9c75ee0 Fix tests after updating from develop, changes applied for migrating to Spring Boot 2 2019-09-23 17:35:04 +02:00
35c1305ce9 Merge conflicts resolved 2019-09-23 07:34:27 +02:00
261f947777 Fix 2019-09-20 17:45:33 +02:00
c8ef848657 Fix 2019-09-20 17:36:15 +02:00
f29b923eef FIx? 2019-09-20 17:10:58 +02:00
6fe5831f11 FIx? 2019-09-20 16:46:26 +02:00
cf00454f8b Testing issue 2019-09-20 08:30:07 +02:00
e8d086ac9b All successful 2019-09-20 07:59:04 +02:00
3ec4592fb2 Merge pull request #657 from WebGoat/xxe-int-test
XXE tests added
2019-09-19 18:09:02 +02:00
d7a2596670 Update lesson template 2019-09-19 07:54:30 +02:00
9c431eb2a3 Remove (was not generated btw) 2019-09-18 18:03:40 +02:00
1be9397c21 Add notifications from Travis 2019-09-18 18:02:14 +02:00
82ad0a7cc7 Finally working 2019-09-18 17:53:43 +02:00
4777dab57a review comments processed 2019-09-18 17:46:32 +02:00
a5cb5b0e8e removed log in checkresults 2019-09-18 16:16:44 +02:00
30d38f9b56 completed test 2019-09-18 16:10:52 +02:00
ec236a4ff5 First steps in XXE integration tests 2019-09-18 14:48:34 +02:00
57e6a84cef fixed and improved first two jwt challenges 2019-09-17 18:33:05 +02:00
2b01cbcb75 Fixed last tests 2019-09-16 07:43:22 +02:00
f774364461 Working unit tests 2019-09-13 20:05:25 +02:00
04f1b9a282 Update to the copyright 2019-09-13 19:27:25 +02:00
71dea87653 WebWolf test working again 2019-09-13 19:25:09 +02:00
dceb375d5e WIP 2019-09-13 18:57:40 +02:00
5e6f825e64 WIP 2019-09-13 16:42:13 +02:00
361249c666 First attempt at moving to Spring Boot 2 2019-09-12 17:22:03 +02:00
fb2e11fe11 fix for complete progress of sql mitigations and integration test 2019-09-10 13:58:58 +02:00
a56f41e0ea Merge branch 'pr/579' into develop 2019-09-10 13:55:43 +02:00
43c25dc3bb Modified PR to reflect coding style 2019-09-10 13:53:30 +02:00
6e9a52a05e Merge pull request #647 from WebGoat/separate_project
Nice work. I will add some tests for the missing parts in the SQL mitigations (in a separate pull request)
2019-09-09 14:05:21 +02:00
f7c8a271aa Fixed small typos 2019-09-09 13:55:24 +02:00
7a4f6e6fd3 Merge branch 'JeffreyWagnerBHN-develop' into develop 2019-09-09 13:54:38 +02:00
aec051a9f1 Fixed minor spelling mistake 2019-09-09 13:41:38 +02:00
bf52e7a992 Fixed checking of server already running 2019-09-09 11:37:26 +02:00
0982bd982c Review comments processed:
- Ports can now be changed
- User is now a default user making it easier to login and look around after a failure
2019-09-08 18:52:12 +02:00
75a174ff7b Fixed description and grammer 2019-09-06 21:12:55 -04:00
2283f945a9 Fix failing configuration 2019-08-25 17:53:36 +02:00
ff530e926e Use separate project for integration tests so we can start WebGoat and WebWolf 2019-08-25 17:43:14 +02:00
139651615e Make lesson csrf-7 stricter (do not allow invalid JSON, e.g. trailing =) 2019-08-22 17:44:52 +02:00
924a53c22a fixed sql adv 5 progress and added prove in integration test 2019-08-22 17:44:34 +02:00
c93563da3f Merge pull request #643 from TortugaAttack/multipleTracker45
Fixed #642 - multiple tracker for one user fixed
2019-08-22 15:07:59 +02:00
73553d91d3 Merge pull request #639 from jskiba99/patch-2
Update CrossSiteScripting_content9.adoc
2019-08-22 11:14:38 +02:00
f0d1555a09 Fixed #45 - multiple tracker for one user fixed 2019-08-21 23:38:27 +02:00
6d36e7db74 Added new endpoint for POST so it will give feedback to the UI. It now
ended up in a HTTP/405 which does not give any feedback to the UI
2019-08-17 13:52:59 +02:00
e01c2a35ce Add test case for security question assignment and the tracking is now
done with a session scoped bean
2019-08-06 19:04:07 +02:00
7d9f24c86b Update CrossSiteScripting_content9.adoc
Fix broken resource link
2019-08-06 05:26:05 -04:00
18eee4df58 Fix for issue with timestamp not being parsed when sending to WebWolf
timestamp was already fixed at LocalDateTime.now() however WebGoat still
send the timestamp along, removed it
2019-07-28 20:50:19 +02:00
e61c943f97 #601 bug: username is case sensitive, but email in general is not
Opted for completing remove support for uppercase letters in username
this way we never come across issued with casing in WebGoat
2019-07-28 20:48:20 +02:00
d2e23f6b8e reduce logging 2019-07-25 20:17:52 +02:00
ffbc808e26 Integration test support 2019-07-25 20:17:52 +02:00
ae674b9297 Merge pull request #620 from zubcevic/july2019-bugfixes
increased sql form fields and fixed chrome progress
2019-07-25 08:39:34 +02:00
33c73a7dca Adding new developer 2019-07-24 20:37:32 +02:00
216b29fca2 Clean up in pom files 2019-07-24 20:37:32 +02:00
ee0988effe Merge pull request #627 from WebGoat/gh-jwhite-patch-1
Delete do-not-merge.md
2019-07-23 14:19:26 -06:00
67440a6cc8 Delete do-not-merge.md
removing earlier test file
2019-07-23 14:18:51 -06:00
6c8921a951 Merge pull request #625 from WebGoat/another-ci-fail-test
Create do-not-merge.md
2019-07-23 11:41:35 -06:00
b395be9bd0 Create do-not-merge.md
testing a status check/branch protection thing
2019-07-23 10:38:25 -06:00
7ad3996f2f fix 6a6b page 2019-07-22 15:36:31 +02:00
b65644edee progress fix for SqlInjectionMitigations 2019-07-22 12:16:18 +02:00
ea38973068 UTF-8 config added for ThymeLeaf 2019-07-22 08:21:34 +02:00
7d0a63ac95 small html changes to improve progress 2019-07-20 09:34:27 +02:00
f9e78739f3 reverted mandatory file encoding which will make it worse on windows 2019-07-20 09:13:21 +02:00
656fa40182 style sheet and advanced sql 2019-07-19 16:49:30 +02:00
99435a1073 increased sql form fields and fixed chrome progress 2019-07-19 12:16:06 +02:00
9471e53818 Fix image names for google chrome dev tools lesson 2019-07-14 12:40:05 +02:00
d814522223 Fix test for HTTP proxy lesson 2019-07-14 12:39:07 +02:00
2eaf263e81 Improve task description for HTTP proxy lesson 2019-07-14 12:39:07 +02:00
41f252970b corrected path in pom 2019-07-14 12:38:11 +02:00
63a1097466 owasp categories 2019-07-14 12:38:11 +02:00
bc0d803123 add login&pwd in JDBC url for PostgreSQL
I really don't know why exactly spring parameters are not used here,
probably for schema creation step. Until changing what the application does on startup
this will make it 'just work' without extra changes.
2019-07-14 12:29:51 +02:00
12de48ebbb additional environment entries to support https on webgoat 2019-07-14 12:18:07 +02:00
62fbd6d340 Merge pull request #610 from johannesegger/patch-1
Fix typo in CIA lesson
2019-07-12 17:21:46 -06:00
e36b4c3910 Merge pull request #618 from matthias-g/csrf-3-post
Do not allow trivial solution to CSRF-3
2019-07-12 17:16:23 -06:00
97f66545e0 In CSRF-3 use POST instead of GET to prevent solving the assignment just by opening the URL in a new tab 2019-07-12 17:25:58 +02:00
27125acd22 Fix issue with maven wrapper using TLS 1.2 as it no longer is supported 2019-07-09 20:19:54 +02:00
1aa98be908 Fix issue with maven wrapper using TLS 1.2 as it no longer is supported 2019-07-09 20:18:54 +02:00
cb667094f2 update jar plugin version 2019-07-09 19:11:52 +02:00
703b6c676e Fix typo 2019-06-14 15:09:55 +02:00
00deb66ad9 Small update for password reset lesson 2019-05-09 09:17:11 +02:00
2a5e8dfdac Add missing step necessary to finish the release 2019-05-03 11:20:53 +02:00
98537426f2 SNAPSHOT version 2019-05-03 11:15:11 +02:00
529e8d73e1 Merge tag 'v8.0.0.M25' into develop
New release
2019-05-03 09:57:22 +02:00
0ac8b7c716 Merge branch 'develop' into add-user-validator-tests 2019-03-26 20:36:06 +00:00
331d9c8dd4 add authur tag to test class 2019-03-26 20:33:11 +00:00
c6c0cc60f9 Add UserValidator tests + minor code clean up 2019-03-26 20:23:28 +00:00
a242347ee0 add UserService unit test, modify UserService 2019-03-26 12:05:42 +00:00
89037c3dfb Fim simple email assignment typo 2019-03-26 10:01:07 +00:00
1884 changed files with 42847 additions and 162781 deletions

4
.dockerignore Normal file
View File

@ -0,0 +1,4 @@
**
!/target
!/config/desktop

15
.editorconfig Normal file
View File

@ -0,0 +1,15 @@
root = true
[*]
charset = utf-8
end_of_line = lf
indent_size = 4
indent_style = space
insert_final_newline = true
max_line_length = 120
tab_width = 4
ij_continuation_indent_size = 8
ij_formatter_off_tag = @formatter:off
ij_formatter_on_tag = @formatter:on
ij_formatter_tags_enabled = false
ij_java_names_count_to_use_import_on_demand = 999

1
.github/FUNDING.yml vendored Normal file
View File

@ -0,0 +1 @@
custom: https://owasp.org/donate/?reponame=www-project-webgoat&title=OWASP+WebGoat

14
.github/dependabot.yml vendored Normal file
View File

@ -0,0 +1,14 @@
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "maven"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "weekly"

10
.github/lock.yml vendored Normal file
View File

@ -0,0 +1,10 @@
---
daysUntilLock: 365
skipCreatedBefore: false
exemptLabels: []
lockLabel: false
lockComment: >
This thread has been automatically locked because it has not had
recent activity after it was closed. :lock: Please open a new issue
for regressions or related bugs.
setLockReason: false

10
.github/stale.yml vendored Normal file
View File

@ -0,0 +1,10 @@
---
daysUntilStale: 90
daysUntilClose: 14
onlyLabels:
- waiting for input
- wontfix
staleLabel: stale
markComment: >
This issue has been automatically marked as `stale` because it has not had recent activity. :calendar: It will be _closed automatically_ in one week if no further activity occurs.
closeComment: false

54
.github/workflows/branchbuild.txt vendored Normal file
View File

@ -0,0 +1,54 @@
name: "Branch build"
on:
push:
branches:
- "*"
- "!main"
jobs:
branch-build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ ubuntu-latest, windows-latest, macos-latest ]
java-version: [ 21 ]
steps:
- uses: actions/checkout@v4
- name: Set up JDK ${{ matrix.java-version }}
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: ${{ matrix.java-version }}
architecture: x64
- name: Cache Maven packages
uses: actions/cache@v3.3.1
with:
path: ~/.m2
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
restore-keys: ${{ runner.os }}-m2-
- name: Build with Maven
run: mvn --no-transfer-progress verify
- name: "Set up QEMU"
if: runner.os == 'Linux'
uses: docker/setup-qemu-action@v2.2.0
- name: "Set up Docker Buildx"
if: runner.os == 'Linux'
uses: docker/setup-buildx-action@v2
- name: "Verify Docker WebGoat build"
if: runner.os == 'Linux'
uses: docker/build-push-action@v5.1.0
with:
context: ./
file: ./Dockerfile
push: false
build-args: |
webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}
- name: "Verify Docker WebGoat desktop build"
uses: docker/build-push-action@v5.1.0
if: runner.os == 'Linux'
with:
context: ./
file: ./Dockerfile_desktop
push: false
build-args: |
webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}

51
.github/workflows/build.yml vendored Normal file
View File

@ -0,0 +1,51 @@
name: "Main / Pull requests build"
on:
pull_request:
paths-ignore:
- '.txt'
- 'LICENSE'
- 'docs/**'
branches: [ main ]
push:
branches:
- main
jobs:
pre-commit:
name: Pre-commit check
runs-on: ubuntu-latest
steps:
- name: Checkout git repository
uses: actions/checkout@v4.1.6
- name: Setup python
uses: actions/setup-python@v5
with:
python-version: "3.9"
- uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: '23'
- name: Pre-commit checks
uses: pre-commit/action@v3.0.1
- name: pre-commit-c-lite
uses: pre-commit-ci/lite-action@v1.1.0
if: always()
build:
runs-on: ${{ matrix.os }}
needs: [ pre-commit ]
strategy:
fail-fast: true
matrix:
os: [ windows-latest, ubuntu-latest, macos-13 ]
max-parallel: 1
steps:
- uses: actions/checkout@v4.1.6
- name: Set up JDK 23
uses: actions/setup-java@v4.2.1
with:
distribution: 'temurin'
java-version: 23
architecture: x64
cache: 'maven'
- name: Build with Maven
run: mvn --no-transfer-progress verify

143
.github/workflows/release.yml vendored Normal file
View File

@ -0,0 +1,143 @@
name: "Release Pipeline"
on:
push:
tags:
- v*
jobs:
release:
if: github.repository == 'WebGoat/WebGoat'
name: Release WebGoat
runs-on: ubuntu-latest
permissions:
contents: write
environment:
name: release
steps:
- uses: actions/checkout@v4
- name: Set up JDK 23
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: 23
architecture: x64
cache: 'maven'
- name: "Set labels for ${{ github.ref }}"
run: |
echo "WEBGOAT_TAG_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
WEBGOAT_MAVEN_VERSION=${{ github.ref_name }}
echo "WEBGOAT_MAVEN_VERSION=${WEBGOAT_MAVEN_VERSION:1}" >> $GITHUB_ENV
- name: Build with Maven
run: |
mvn --no-transfer-progress versions:set -DnewVersion=${{ env.WEBGOAT_MAVEN_VERSION }}
mvn --no-transfer-progress install -DskipTests
- name: "Create release"
uses: softprops/action-gh-release@v1
with:
draft: false
files: |
target/webgoat-${{ env.WEBGOAT_MAVEN_VERSION }}.jar
body: |
## Version ${{ github.ref_name }}
### New functionality
- test
### Bug fixes
- [#743 - Character encoding errors](https://github.com/WebGoat/WebGoat/issues/743)
Full change log: https://github.com/WebGoat/WebGoat/compare/${{ github.ref_name }}...${{ github.ref_name }}
## Contributors
Special thanks to the following contributors providing us with a pull request:
- Person 1
- Person 2
And everyone who provided feedback through Github.
Team WebGoat
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: "Set up QEMU"
uses: docker/setup-qemu-action@v3.4.0
with:
platforms: all
- name: "Set up Docker Buildx"
uses: docker/setup-buildx-action@v3
- name: "Login to dockerhub"
uses: docker/login-action@v3.3.0
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: "Build and push WebGoat"
uses: docker/build-push-action@v6.14.0
with:
context: ./
file: ./Dockerfile
push: true
platforms: linux/amd64, linux/arm64
tags: |
webgoat/webgoat:${{ env.WEBGOAT_TAG_VERSION }}
webgoat/webgoat:latest
build-args: |
webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}
- name: "Build and push WebGoat desktop"
uses: docker/build-push-action@v6.14.0
with:
context: ./
file: ./Dockerfile_desktop
push: true
platforms: linux/amd64, linux/arm64
tags: |
webgoat/webgoat-desktop:${{ env.WEBGOAT_TAG_VERSION }}
webgoat/webgoat-desktop:latest
build-args: |
webgoat_version=${{ env.WEBGOAT_MAVEN_VERSION }}
new_version:
if: github.repository == 'WebGoat/WebGoat'
name: Update to next SNAPSHOT version
needs: [ release ]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up JDK 23
uses: actions/setup-java@v4
with:
distribution: 'temurin'
java-version: 23
architecture: x64
- name: Set version to next snapshot
run: |
mvn build-helper:parse-version versions:set -DnewVersion=\${parsedVersion.majorVersion}.\${parsedVersion.minorVersion}-SNAPSHOT versions:commit
- name: Push the changes to new branch
uses: devops-infra/action-commit-push@v0.10.0
with:
github_token: "${{ secrets.GITHUB_TOKEN }}"
add_timestamp: true
commit_message: "Updating to the new development version"
force: false
- name: Create PR
uses: devops-infra/action-pull-request@v0.6.0
with:
github_token: "${{ secrets.GITHUB_TOKEN }}"
title: ${{ github.event.commits[0].message }}
target_branch: main

17
.github/workflows/welcome.yml vendored Normal file
View File

@ -0,0 +1,17 @@
name: Welcome
on:
issues:
types:
- opened
jobs:
greeting:
if: github.repository == 'WebGoat/WebGoat'
runs-on: ubuntu-latest
steps:
- uses: actions/first-interaction@v1.3.0
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
issue-message: 'Thanks for submitting your first issue, we will have a look as quickly as possible.'
pr-message: 'Thanks so much for your contribution, really appreciated! We will have a look and merge it if everything checks out!'

10
.gitignore vendored
View File

@ -15,6 +15,7 @@
/.externalToolBuilders/
.project
*/target/*
*.pmd
mongo-data/*
.classpath
.idea/
@ -52,3 +53,12 @@ webgoat.log
webgoat.properties
webgoat.script
TestClass.class
**/*.flattened-pom.xml
/.gitconfig
webgoat.gitconfig
node_modules/
/test-results/
/playwright-report/
/blob-report/
/playwright/.cache/

117
.mvn/wrapper/MavenWrapperDownloader.java vendored Normal file
View File

@ -0,0 +1,117 @@
/*
* Copyright 2007-present the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import java.net.*;
import java.io.*;
import java.nio.channels.*;
import java.util.Properties;
public class MavenWrapperDownloader {
private static final String WRAPPER_VERSION = "0.5.5";
/**
* Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
*/
private static final String DEFAULT_DOWNLOAD_URL = "https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/"
+ WRAPPER_VERSION + "/maven-wrapper-" + WRAPPER_VERSION + ".jar";
/**
* Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
* use instead of the default one.
*/
private static final String MAVEN_WRAPPER_PROPERTIES_PATH =
".mvn/wrapper/maven-wrapper.properties";
/**
* Path where the maven-wrapper.jar will be saved to.
*/
private static final String MAVEN_WRAPPER_JAR_PATH =
".mvn/wrapper/maven-wrapper.jar";
/**
* Name of the property which should be used to override the default download url for the wrapper.
*/
private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
public static void main(String args[]) {
System.out.println("- Downloader started");
File baseDirectory = new File(args[0]);
System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
// If the maven-wrapper.properties exists, read it and check if it contains a custom
// wrapperUrl parameter.
File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
String url = DEFAULT_DOWNLOAD_URL;
if(mavenWrapperPropertyFile.exists()) {
FileInputStream mavenWrapperPropertyFileInputStream = null;
try {
mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
Properties mavenWrapperProperties = new Properties();
mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
} catch (IOException e) {
System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
} finally {
try {
if(mavenWrapperPropertyFileInputStream != null) {
mavenWrapperPropertyFileInputStream.close();
}
} catch (IOException e) {
// Ignore ...
}
}
}
System.out.println("- Downloading from: " + url);
File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
if(!outputFile.getParentFile().exists()) {
if(!outputFile.getParentFile().mkdirs()) {
System.out.println(
"- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'");
}
}
System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
try {
downloadFileFromURL(url, outputFile);
System.out.println("Done");
System.exit(0);
} catch (Throwable e) {
System.out.println("- Error downloading");
e.printStackTrace();
System.exit(1);
}
}
private static void downloadFileFromURL(String urlString, File destination) throws Exception {
if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
String username = System.getenv("MVNW_USERNAME");
char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
Authenticator.setDefault(new Authenticator() {
@Override
protected PasswordAuthentication getPasswordAuthentication() {
return new PasswordAuthentication(username, password);
}
});
}
URL website = new URL(urlString);
ReadableByteChannel rbc;
rbc = Channels.newChannel(website.openStream());
FileOutputStream fos = new FileOutputStream(destination);
fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
fos.close();
rbc.close();
}
}

View File

@ -1 +1,2 @@
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.5.4/apache-maven-3.5.4-bin.zip
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.1/apache-maven-3.8.1-bin.zip
wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar

28
.pre-commit-config.yaml Normal file
View File

@ -0,0 +1,28 @@
ci:
autofix_commit_msg: |
[pre-commit.ci] auto fixes from pre-commit.com hooks
autofix_prs: false # managed in the action step
autoupdate_branch: ""
autoupdate_commit_msg: "[pre-commit.ci] pre-commit autoupdate"
autoupdate_schedule: weekly
skip: []
submodules: false
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.4.0
hooks:
- id: check-yaml
- id: end-of-file-fixer
exclude: ^(README.md|CREATE_RELEASE.md)
- id: trailing-whitespace
- repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
rev: v9.5.0
hooks:
- id: commitlint
stages: [commit-msg]
- repo: https://github.com/ejba/pre-commit-maven
rev: v0.3.4
hooks:
- id: maven
args: [ 'clean compile' ]
- id: maven-spotless-apply

View File

@ -1,47 +0,0 @@
services:
- docker
language: java
jdk:
- openjdk11
install: "/bin/true"
script:
- export BRANCH=$(if [ "$TRAVIS_PULL_REQUEST" == "false" ]; then echo $TRAVIS_BRANCH; else echo $TRAVIS_PULL_REQUEST_BRANCH; fi)
- echo "TRAVIS_BRANCH=$TRAVIS_BRANCH, PR=$PR, BRANCH=$BRANCH"
- if [ ! -z "${TRAVIS_TAG}" ]; then mvn versions:set -DnewVersion=${TRAVIS_TAG:1}; fi
- mvn clean install -q
cache:
directories:
- "$HOME/.m2"
before_deploy:
- export WEBGOAT_SERVER_TARGET_DIR=$HOME/build/$TRAVIS_REPO_SLUG/webgoat-server/target
- export WEBWOLF_TARGET_DIR=$HOME/build/$TRAVIS_REPO_SLUG/webwolf/target
- export WEBGOAT_ARTIFACTS_FOLDER=$HOME/build/$TRAVIS_REPO_SLUG/Deployable_Artifacts/
- mkdir -p $WEBGOAT_ARTIFACTS_FOLDER
- cp -fa $WEBGOAT_SERVER_TARGET_DIR/*.jar $WEBGOAT_ARTIFACTS_FOLDER/
- cp -fa $WEBWOLF_TARGET_DIR/*.jar $WEBGOAT_ARTIFACTS_FOLDER/
- echo "Contents of artifacts folder:"
- ls $WEBGOAT_ARTIFACTS_FOLDER
deploy:
- provider: script
skip_cleanup: true
script: bash scripts/deploy-webgoat.sh
on:
repo: WebGoat/WebGoat
tags: true
- provider: releases
skip_cleanup: true
overwrite: true
api_key:
#api-key from webgoat-github user
secure: pJOLBnl6427PcVg/tVy/qB18JC7b8cKpffau+IP0pjdSt7KUfBdBY3QuJ7mrM65zRoVILzggLckaew2PlRmYQRdumyWlyRn44XiJ9KO4n6Bsufbz+ictB4ggtozpp9+I9IIUh1TmqypL9lhkX2ONM9dSHmyblYpAAgMuYSK8FYc=
file_glob: true
file: $WEBGOAT_ARTIFACTS_FOLDER/*
on:
repo: WebGoat/WebGoat
tags: true
env:
global:
#Docker login
- secure: XgPc0UKRTUI70I4YWNQpThPPWeQIxkmzh1GNoR/SSDC2GPIBq3EfkkbSQewqil8stTy+S1/xSzc0JXG8NTn7UOxHVHA/2nhI6jX9E+DKtXQ89YwmaDNQjkbMjziAtDCIex+5TRykxNfkxj6VPYbDssrzI7iJXOIZVj/HoyO3O5E=
#Docker password
- secure: aly5TKBUK9sIiqtMbytNNPZHQhC0a7Yond5tEtuJ8fO+j/KZB4Uro3I6BhzYjGWFb5Kndd0j2TXHPFvtOl402J1CmFsY3v0BhilQd0g6zOssp5T0A73m8Jgq4ItV8wQJJy2bQsXqL1B+uFYieYPiMchj7JxWW0vBn7TV5b68l6U=

60
CODE_OF_CONDUCT.md Normal file
View File

@ -0,0 +1,60 @@
# Contributor Covenant Code of Conduct
## Our Pledge
In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
## Our Standards
Examples of behavior that contributes to creating a positive environment include:
- Using welcoming and inclusive language
- Being respectful of differing viewpoints and experiences
- Gracefully accepting constructive criticism
- Focusing on what is best for the community
- Showing empathy towards other community members
Examples of unacceptable behavior by participants include:
- The use of sexualized language or imagery and unwelcome sexual attention or advances
- Trolling, insulting/derogatory comments, and personal or political attacks
- Public or private harassment
- Publishing others' private information, such as a physical or electronic address, without explicit permission
- Misusing the context of the WebGoat project for commercial goals (e.g. adding sales pitches to the codebase or to communication channels used by the project, such as Slack).
- Other conduct which could reasonably be considered inappropriate in a professional setting
## Our Responsibilities
Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
## Disclaimer
The WebGoat project and its materials are conceived for educational and research purposes only.
Refrain from violating the laws in your country by carefully consulting them before executing any tests against web applications or other assets utilizing the WebGoat (or Webwolf) materials.
The WebGoat project is also NOT supporting unethical activities in any way. If you come across such requests, please reach out to the project leaders and raise this to them.
Neither OWASP, the WebGoat project leaders, authors or anyone else involved in this project is going to take responsibility for your actions.
The intention of the WebGoat is not to encourage hacking or malicious activities! Instead, the goal of the project is to learn different hacking techniques and offer ways to reduce or mitigate that risk.
## Scope
This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community includes using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
## Enforcement
Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at nanne.baars@owasp.org.
All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
## Attribution
This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org "Contributor Covenant homepage"), [version 1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html "Code of Conduct version 1.4").
For answers to common questions about this code of conduct, see [the Contributor Covenant FAQ](https://www.contributor-covenant.org/faq)

119
CONTRIBUTING.md Normal file
View File

@ -0,0 +1,119 @@
# Contributing
[![GitHub contributors](https://img.shields.io/github/contributors/WebGoat/WebGoat.svg)](https://github.com/WebGoat/WebGoat/graphs/contributors)
![GitHub issues by-label "help wanted"](https://img.shields.io/github/issues/WebGoat/WebGoat/help%20wanted.svg)
![GitHub issues by-label "good first issue"](https://img.shields.io/github/issues/WebGoat/WebGoat/good%20first%20issue.svg)
[![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white)](https://conventionalcommits.org)
This document describes how you can contribute to WebGoat. Please read it carefully.
**Table of Contents**
* [How to Contribute to the Project](#how-to-contribute-to-the-project)
* [How to set up your Contributor Environment](#how-to-set-up-your-contributor-environment)
* [How to get your PR Accepted](#how-to-get-your-pr-accepted)
## How to Contribute to the project
There are a couple of ways on how you can contribute to the project:
* **File [issues](https://github.com/WebGoat/WebGoat/issues "Webgoat Issues")** for missing content or errors. Explain what you think is missing and give a suggestion as to where it could be added.
* **Create a [pull request (PR)](https://github.com/WebGoat/WebGoat/pulls "Create a pull request")**. This is a direct contribution to the project and may be merged after review. You should ideally [create an issue](https://github.com/WebGoat/WebGoat/issues "WebGoat Issues") for any PR you would like to submit, as we can first review the merit of the PR and avoid any unnecessary work. This is of course not needed for small modifications such as correcting typos.
* **Help out financially** by donating via [OWASP donations](https://owasp.org/donate/?reponame=www-project-webgoat&title=OWASP+WebGoat).
## How to get your PR accepted
Your PR is valuable to us, and to make sure we can integrate it smoothly, we have a few items for you to consider. In short:
The minimum requirements for code contributions are:
1. The code _must_ be compliant with the configured Java Google Formatter, Checkstyle and PMD rules.
2. All new and changed code _should_ have a corresponding unit and/or integration test.
3. New and changed lessons _must_ have a corresponding integration test.
4. [Status checks](https://docs.github.com/en/github/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/about-status-checks) should pass for your last commit.
Additionally, the following guidelines can help:
### Keep your pull requests limited to a single issue
Pull requests should be as small/atomic as possible. Large, wide-sweeping changes in a pull request will be **rejected**, with comments to isolate the specific code in your pull request. Some examples:
* If you are making spelling corrections in the docs, don't modify other files.
* If you are adding new functions don't '*cleanup*' unrelated functions. That cleanup belongs in another pull request.
### Write a good commit message
* We use [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) and use the following types:
- fix:
- feat:
- build:
- chore:
- ci:
- docs:
- refactor:
- test:
Using this style of commits makes it possible to create our release notes automatically.
* Explain why you make the changes. [More infos about a good commit message.](https://betterprogramming.pub/stop-writing-bad-commit-messages-8df79517177d)
* If you fix an issue with your commit, please close the issue by [adding one of the keywords and the issue number](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) to your commit message.
For example: `Fix #545` or `Closes #10`
## How to set up your Contributor Environment
1. Create a GitHub account. Multiple different GitHub subscription plans are available, but you only need a free one. Follow [these steps](https://help.github.com/en/articles/signing-up-for-a-new-github-account "Signing up for a new GitHub account") to set up your account.
2. Fork the repository. Creating a fork means creating a copy of the repository on your own account, which you can modify without any impact on this repository. GitHub has an [article that describes all the needed steps](https://help.github.com/en/articles/fork-a-repo "Fork a repo").
3. Clone your own repository to your host computer so that you can make modifications. If you followed the GitHub tutorial from step 2, you have already done this.
4. Go to the newly cloned directory "WebGoat" and add the remote upstream repository:
```bash
$ git remote -v
origin git@github.com:<your Github handle>/WebGoat.git (fetch)
origin git@github.com:<your Github handle>/WebGoat.git (push)
$ git remote add upstream git@github.com:WebGoat/WebGoat.git
$ git remote -v
origin git@github.com:<your Github handle>/WebGoat.git (fetch)
origin git@github.com:<your Github handle>/WebGoat.git (push)
upstream git@github.com:OWASP/WebGoat.git (fetch)
upstream git@github.com:OWASP/WebGoat.git (push)
```
See also the GitHub documentation on "[Configuring a remote for a fork](https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/configuring-a-remote-for-a-fork "Configuring a remote for a fork")".
5. Choose what to work on, based on any of the outstanding [issues](https://github.com/WebGoat/WebGoat/issues "WebGoat Issues").
6. Create a branch so that you can cleanly work on the chosen issue: `git checkout -b FixingIssue66`
7. Open your favorite editor and start making modifications. We recommend using the [IntelliJ Idea](https://www.jetbrains.com/idea/).
8. After your modifications are done, push them to your forked repository. This can be done by executing the command `git add MYFILE` for every file you have modified, followed by `git commit -m 'your commit message here'` to commit the modifications and `git push` to push your modifications to GitHub.
9. Create a Pull Request (PR) by going to your fork, <https://github.com/Your_Github_Handle/WebGoat> and click on the "New Pull Request" button. The target branch should typically be the Master branch. When submitting a PR, be sure to follow the checklist that is provided in the PR template. The checklist itself will be filled out by the reviewer.
10. Your PR will be reviewed and comments may be given. In order to process a comment, simply make modifications to the same branch as before and push them to your repository. GitHub will automatically detect these changes and add them to your existing PR.
11. When starting on a new PR in the future, make sure to always keep your local repo up to date:
```bash
$ git fetch upstream
$ git merge upstream/main
```
See also the following article for further explanation on "[How to Keep a Downstream git Repository Current with Upstream Repository Changes](https://medium.com/sweetmeat/how-to-keep-a-downstream-git-repository-current-with-upstream-repository-changes-10b76fad6d97 "How to Keep a Downstream git Repository Current with Upstream Repository Changes")".
If at any time you want to work on a different issue, you can simply switch to a different branch, as explained in step 5.
> Tip: Don't try to work on too many issues at once though, as it will be a lot more difficult to merge branches the longer they are open.
## What not to do
Although we greatly appreciate any and all contributions to the project, there are a few things that you should take into consideration:
* The WebGoat project should not be used as a platform for advertisement for commercial tools, companies or individuals. Write-ups should be written with free and open-source tools in mind and commercial tools are typically not accepted, unless as a reference in the security tools section.
* Unnecessary self-promotion of tools or blog posts is frowned upon. If you have a relation with on of the URLs or tools you are referencing, please state so in the PR so that we can verify that the reference is in line with the rest of the guide.
Please be sure to take a careful look at our [Code of Conduct](https://github.com/WebGoat/WebGoat/blob/master/CODE_OF_CONDUCT.md) for all the details.

22
COPYRIGHT.txt Normal file
View File

@ -0,0 +1,22 @@
This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
SPDX-License-Identifier: GPL-2.0-or-later
Copyright (c) 2002 - 2016 Bruce Mayhew
Copyright (c) 2014 - $today.year Nanne Baars
This program is free software; you can redistribute it and/or modify it under the terms of the
GNU General Public License as published by the Free Software Foundation; either version 2 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if
not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
02111-1307, USA.
Getting Source ==============
Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.

View File

@ -1,27 +0,0 @@
## Release WebGoat
### Version numbers
For WebGoat we use milestone releases first before we release the official version, we use `v8.0.0.M3` while tagging
and 8.0.0.M3 in the `pom.xml`. When we create the final release we remove the milestone release and use
`v8.0.0` and 8.0.0 in the `pom.xml`
At the moment we use Gitflow, for a release you create a new release branch and take the following steps:
```
git checkout develop
git flow release start <version>
mvn versions:set <<version>
git commit -am "New release, updating pom.xml"
git flow release publish
git push origin develop
git push origin master
git push --tags
```
Now Travis takes over and will create the release in Github and on Docker Hub.
NOTE: the `mvn versions:set` command above is just there to make sure the master branch contains the latest version

21
CREATE_RELEASE.md Normal file
View File

@ -0,0 +1,21 @@
## Release WebGoat
### Version numbers
For WebGoat we use milestone releases first before we release the official version, we use `v2023.01` while tagging
and 2023.01 in the `pom.xml`.
### Release notes:
Update the release notes with the correct version. Use `git shortlog -s -n --since "JAN 06 2023"` for the list of
committers. In order to fetch the list of issues included use: `git log --graph --pretty='%C(auto)%d%Creset%s' v2023.4..origin/main`
```
mvn versions:set
<< update release notes >>
mvn verify
git commit ....
git tag v2023.01
git push --tags
```

40
Dockerfile Normal file
View File

@ -0,0 +1,40 @@
# We need JDK as some of the lessons needs to be able to compile Java code
FROM docker.io/eclipse-temurin:23-jdk-noble
LABEL name="WebGoat: A deliberately insecure Web Application"
LABEL maintainer="WebGoat team"
RUN \
useradd -ms /bin/bash webgoat && \
chgrp -R 0 /home/webgoat && \
chmod -R g=u /home/webgoat
USER webgoat
COPY --chown=webgoat target/webgoat-*.jar /home/webgoat/webgoat.jar
EXPOSE 8080
EXPOSE 9090
ENV TZ=Europe/Amsterdam
WORKDIR /home/webgoat
ENTRYPOINT [ "java", \
"-Duser.home=/home/webgoat", \
"-Dfile.encoding=UTF-8", \
"--add-opens", "java.base/java.lang=ALL-UNNAMED", \
"--add-opens", "java.base/java.util=ALL-UNNAMED", \
"--add-opens", "java.base/java.lang.reflect=ALL-UNNAMED", \
"--add-opens", "java.base/java.text=ALL-UNNAMED", \
"--add-opens", "java.desktop/java.beans=ALL-UNNAMED", \
"--add-opens", "java.desktop/java.awt.font=ALL-UNNAMED", \
"--add-opens", "java.base/sun.nio.ch=ALL-UNNAMED", \
"--add-opens", "java.base/java.io=ALL-UNNAMED", \
"--add-opens", "java.base/java.util=ALL-UNNAMED", \
"--add-opens", "java.base/sun.nio.ch=ALL-UNNAMED", \
"--add-opens", "java.base/java.io=ALL-UNNAMED", \
"-Drunning.in.docker=true", \
"-jar", "webgoat.jar", "--server.address", "0.0.0.0" ]
HEALTHCHECK --interval=5s --timeout=3s \
CMD curl --fail http://localhost:8080/WebGoat/actuator/health || exit 1

47
Dockerfile_desktop Normal file
View File

@ -0,0 +1,47 @@
FROM lscr.io/linuxserver/webtop:ubuntu-xfce
LABEL name="WebGoat: A deliberately insecure Web Application"
LABEL maintainer="WebGoat team"
WORKDIR /config
COPY target/webgoat-*.jar /config/webgoat.jar
COPY config/desktop/start_webgoat.sh /config/start_webgoat.sh
COPY config/desktop/start_zap.sh /config/start_zap.sh
COPY config/desktop/WebGoat.txt /config/Desktop/
RUN \
apt-get update && \
apt-get --yes install vim nano gzip
RUN \
case $(uname -m) in \
x86_64) ARCH=x64;; \
aarch64) ARCH=aarch64;; \
*) ARCH=unknown;; \
esac && \
echo ${ARCH}
RUN \
curl -LO https://github.com/zaproxy/zaproxy/releases/download/v2.15.0/ZAP_2.15.0_Linux.tar.gz && \
tar zfxv ZAP_2.15.0_Linux.tar.gz && \
rm -rf ZAP_2.15.0_Linux.tar.gz
RUN \
case $(uname -m) in \
x86_64) ARCH=x64;; \
aarch64) ARCH=aarch64;; \
*) ARCH=unknown;; \
esac && \
echo "oeps == ${ARCH}==" && \
curl -L https://github.com/adoptium/temurin23-binaries/releases/download/jdk-23.0.1%2B11/OpenJDK23U-jre_"${ARCH}"_linux_hotspot_23.0.1_11.tar.gz -o java.tar.gz && \
tar zfxv java.tar.gz && \
rm -rf java.tar.gz && \
chmod +x /config/start_webgoat.sh && \
chmod +x /config/start_zap.sh && \
mv /config/jdk-23.0.1+11-jre /config/java-jdk && \
echo "JAVA_HOME=/config/java-jdk/" >> .bash_aliases && \
echo "PATH=$PATH:$JAVA_HOME/bin" >> .bash_aliases
ENV JAVA_HOME=/config/java-jdk
WORKDIR /config/Desktop

7
FAQ.md Normal file
View File

@ -0,0 +1,7 @@
# FAQ for development
## Introduction
### Integration tests fail
Try to run the command in the console `java -jar ...` and remove `-Dlogging.pattern.console=` from the command line.

22
LICENSE.txt Normal file
View File

@ -0,0 +1,22 @@
This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
SPDX-License-Identifier: GPL-2.0-or-later
Copyright (c) 2002 - $today.year Bruce Mayhew
Copyright (c) 2014 - $today.year Nanne Baars
This program is free software; you can redistribute it and/or modify it under the terms of the
GNU General Public License as published by the Free Software Foundation; either version 2 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if
not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
02111-1307, USA.
Getting Source ==============
Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.

1
PULL_REQUEST_TEMPLATE.md Normal file
View File

@ -0,0 +1 @@
Thank you for submitting a pull request to the WebGoat!

158
README.MD
View File

@ -1,158 +0,0 @@
# WebGoat 8: A deliberately insecure Web Application
[![Build Status](https://travis-ci.org/WebGoat/WebGoat.svg?branch=develop)](https://travis-ci.org/WebGoat/WebGoat)
[![Coverage Status](https://coveralls.io/repos/WebGoat/WebGoat/badge.svg?branch=develop&service=github)](https://coveralls.io/github/WebGoat/WebGoat?branch=master)
[![Codacy Badge](https://api.codacy.com/project/badge/b69ee3a86e3b4afcaf993f210fccfb1d)](https://www.codacy.com/app/dm/WebGoat)
[![Dependency Status](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa/badge.svg?style=flat)](https://www.versioneye.com/user/projects/562da95ae346d7000e0369aa)
[![OWASP Labs](https://img.shields.io/badge/owasp-lab%20project-f7b73c.svg)](https://www.owasp.org/index.php/OWASP_Project_Inventory#tab=Labs_Projects)
[![GitHub release](https://img.shields.io/github/release/WebGoat/WebGoat.svg)](https://github.com/WebGoat/WebGoat/releases/latest)
# Introduction
WebGoat is a deliberately insecure web application maintained by [OWASP](http://www.owasp.org/) designed to teach web
application security lessons.
This program is a demonstration of common server-side application flaws. The
exercises are intended to be used by people to learn about application security and
penetration testing techniques.
**WARNING 1:** *While running this program your machine will be extremely
vulnerable to attack. You should disconnect from the Internet while using
this program.* WebGoat's default configuration binds to localhost to minimize
the exposure.
**WARNING 2:** *This program is for educational purposes only. If you attempt
these techniques without authorization, you are very likely to get caught. If
you are caught engaging in unauthorized hacking, most companies will fire you.
Claiming that you were doing security research will not work as that is the
first thing that all hackers claim.*
# Installation Instructions:
## 1. Standalone
Download the latest WebGoat release from [https://github.com/WebGoat/WebGoat/releases](https://github.com/WebGoat/WebGoat/releases)
```Shell
java -jar webgoat-server-8.0.0.VERSION.jar [--server.port=8080] [--server.address=localhost]
```
The latest version of WebGoat needs Java 11. By default WebGoat starts on port 8080 with `--server.port` you can specify a different port. With `server.address` you
can bind it to a different address (default localhost)
## 2. Run using Docker
Every release is also published on [DockerHub]((https://hub.docker.com/r/webgoat/webgoat-8.0/)).
### Using docker-compose
The easiest way to start WebGoat as a Docker container is to use the `docker-compose.yml` [file](https://raw.githubusercontent.com/WebGoat/WebGoat/develop/docker-compose.yml)
from our Github repository. This will start both containers and it also takes care of setting up the
connection between WebGoat and WebWolf.
```shell
curl https://raw.githubusercontent.com/WebGoat/WebGoat/develop/docker-compose.yml | docker-compose -f - up
```
**Important**: the current directory on your host will be mapped into the container for keeping state.
Using the `docker-compose` file will simplify getting WebGoat and WebWolf up and running.
## 3. Run from the sources
### Prerequisites:
* Java 11
* Maven > 3.2.1
* Your favorite IDE
* Git, or Git support in your IDE
Open a command shell/window:
```Shell
git clone git@github.com:WebGoat/WebGoat.git
```
Now let's start by compiling the project.
```Shell
cd WebGoat
git checkout <<branch_name>>
mvn clean install
```
Now we are ready to run the project. WebGoat 8.x is using Spring-Boot.
```Shell
mvn -pl webgoat-server spring-boot:run
```
... you should be running webgoat on localhost:8080/WebGoat momentarily
To change IP address add the following variable to WebGoat/webgoat-container/src/main/resources/application.properties file
```
server.address=x.x.x.x
```
# Vagrant
We supply a complete environment using Vagrant, to run WebGoat with Vagrant you must first have Vagrant and Virtualbox installed.
```shell
$ cd WebGoat/webgoat-images/vagrant-training
$ vagrant up
```
Once the provisioning is complete login to the Virtualbox with username vagrant and password vagrant.
WebGoat and WebWolf will automatically start when you login to this image.
# Building a new Docker image
NOTE: Travis will create a new Docker image automatically when making a new release.
WebGoat now has Docker support for x86 and ARM (raspberry pi).
### Docker on x86
On x86 you can build a container with the following commands:
```Shell
cd WebGoat/
mvn install
cd webgoat-server
docker build -t webgoat/webgoat-8.0 .
docker tag webgoat/webgoat-8.0 webgoat/webgoat-8.0:8.0
docker login
docker push webgoat/webgoat-8.0
```
### Docker on ARM (Raspberry Pi)
On a Raspberry Pi (it has yet been tested with a Raspberry Pi 3 and the hypriot Docker image) you need to build JFFI for
ARM first. This is needed by the docker-maven-plugin ([see here](https://github.com/spotify/docker-maven-plugin/issues/233)):
```Shell
sudo apt-get install build-essential
git clone https://github.com/jnr/jffi.git
cd jffi
ant jar
cd build/jni
sudo cp libjffi-1.2.so /usr/lib
```
When you have done this you can build the Docker container using the following commands:
```Shell
cd WebGoat/
mvn install
cd webgoat-server
mvn docker:build -Drpi=true
docker tag webgoat/webgoat-8.0 webgoat/webgoat-8.0:8.0
docker login
docker push webgoat/webgoat-8.0
```
# Run Instructions:
Once installed connect to http://localhost:8080/WebGoat and http://localhost:9090/WebWolf

165
README.md Normal file
View File

@ -0,0 +1,165 @@
# WebGoat: A deliberately insecure Web Application
[![Build](https://github.com/WebGoat/WebGoat/actions/workflows/build.yml/badge.svg?branch=develop)](https://github.com/WebGoat/WebGoat/actions/workflows/build.yml)
[![java-jdk](https://img.shields.io/badge/java%20jdk-23-green.svg)](https://jdk.java.net/)
[![OWASP Labs](https://img.shields.io/badge/OWASP-Lab%20project-f7b73c.svg)](https://owasp.org/projects/)
[![GitHub release](https://img.shields.io/github/release/WebGoat/WebGoat.svg)](https://github.com/WebGoat/WebGoat/releases/latest)
[![Gitter](https://badges.gitter.im/OWASPWebGoat/community.svg)](https://gitter.im/OWASPWebGoat/community?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
[![Discussions](https://img.shields.io/github/discussions/WebGoat/WebGoat)](https://github.com/WebGoat/WebGoat/discussions)
[![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white)](https://conventionalcommits.org)
# Introduction
WebGoat is a deliberately insecure web application maintained by [OWASP](http://www.owasp.org/) designed to teach web
application security lessons.
This program is a demonstration of common server-side application flaws. The
exercises are intended to be used by people to learn about application security and
penetration testing techniques.
**WARNING 1:** *While running this program your machine will be extremely
vulnerable to attack. You should disconnect from the Internet while using
this program.* WebGoat's default configuration binds to localhost to minimize
the exposure.
**WARNING 2:** *This program is for educational purposes only. If you attempt
these techniques without authorization, you are very likely to get caught. If
you are caught engaging in unauthorized hacking, most companies will fire you.
Claiming that you were doing security research will not work as that is the
first thing that all hackers claim.*
![WebGoat](docs/images/webgoat.png)
# Installation instructions:
For more details check [the Contribution guide](/CONTRIBUTING.md)
## 1. Run using Docker
Already have a browser and ZAP and/or Burp installed on your machine in this case you can run the WebGoat image directly using Docker.
Every release is also published on [DockerHub](https://hub.docker.com/r/webgoat/webgoat).
```shell
docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat
```
For some lessons you need the container run in the same timezone. For this you can set the TZ environment variable.
E.g.
```shell
docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=America/Boise webgoat/webgoat
```
If you want to use OWASP ZAP or another proxy, you can no longer use 127.0.0.1 or localhost. but
you can use custom host entries. For example:
```shell
127.0.0.1 www.webgoat.local www.webwolf.local
```
Then you can run the container with:
```shell
docker run -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e WEBGOAT_HOST=www.webgoat.local -e WEBWOLF_HOST=www.webwolf.local -e TZ=America/Boise webgoat/webgoat
```
Then visit http://www.webgoat.local:8080/WebGoat/ and http://www.webwolf.local:9090/WebWolf/
## 2. Run using Docker with complete Linux Desktop
Instead of installing tools locally we have a complete Docker image based on running a desktop in your browser. This way you only have to run a Docker image which will give you the best user experience.
```shell
docker run -p 127.0.0.1:3000:3000 webgoat/webgoat-desktop
```
## 3. Standalone
Download the latest WebGoat release from [https://github.com/WebGoat/WebGoat/releases](https://github.com/WebGoat/WebGoat/releases)
```shell
export TZ=Europe/Amsterdam # or your timezone
java -Dfile.encoding=UTF-8 -jar webgoat-2023.8.jar
```
Click the link in the log to start WebGoat.
### 3.1 Running on a different port
If for some reason you want to run WebGoat on a different port, you can do so by adding the following parameter:
```shell
java -jar webgoat-2023.8.jar --webgoat.port=8001 --webwolf.port=8002
```
For a full overview of all the parameters you can use, please check the [WebGoat properties file](webgoat-container/src/main/resources/application-{webgoat, webwolf}.properties).
## 4. Run from the sources
### Prerequisites:
* Java 17 or 21
* Your favorite IDE
* Git, or Git support in your IDE
Open a command shell/window:
```Shell
git clone git@github.com:WebGoat/WebGoat.git
```
Now let's start by compiling the project.
```Shell
cd WebGoat
git checkout <<branch_name>>
# On Linux/Mac:
./mvnw clean install
# On Windows:
./mvnw.cmd clean install
# Using docker or podman, you can than build the container locally
docker build -f Dockerfile . -t webgoat/webgoat
```
Now we are ready to run the project. WebGoat is using Spring Boot.
```Shell
# On Linux/Mac:
./mvnw spring-boot:run
# On Windows:
./mvnw.cmd spring-boot:run
```
... you should be running WebGoat on http://localhost:8080/WebGoat momentarily.
Note: The above link will redirect you to login page if you are not logged in. LogIn/Create account to proceed.
To change the IP address add the following variable to the `WebGoat/webgoat-container/src/main/resources/application.properties` file:
```
server.address=x.x.x.x
```
## 4. Run with custom menu
For specialist only. There is a way to set up WebGoat with a personalized menu. You can leave out some menu categories or individual lessons by setting certain environment variables.
For instance running as a jar on a Linux/macOS it will look like this:
```Shell
export TZ=Europe/Amsterdam # or your timezone
export EXCLUDE_CATEGORIES="CLIENT_SIDE,GENERAL,CHALLENGE"
export EXCLUDE_LESSONS="SqlInjectionAdvanced,SqlInjectionMitigations"
java -jar target/webgoat-2023.8-SNAPSHOT.jar
```
Or in a docker run it would (once this version is pushed into docker hub) look like this:
```Shell
docker run -d -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e EXCLUDE_CATEGORIES="CLIENT_SIDE,GENERAL,CHALLENGE" -e EXCLUDE_LESSONS="SqlInjectionAdvanced,SqlInjectionMitigations" webgoat/webgoat
```

34
README_I18N.md Normal file
View File

@ -0,0 +1,34 @@
# Multi language support in WebGoat
WebGoat is mainly written in English, but it does support multiple languages.
## Default language selection
1. Current supported languages are: en, fr, de, nl
2. The primary language is based on the language setting of the browser.
3. If the language is not in the list of supported language, the language is English
4. Once logged in, you can switch between the supported languages using a language dropdown menu on the main page
1. After switching a language you are back at the Introduction page
## Adding a new language
The following steps are required when you want to add a new language
1. Update [main_new.html](src/main/resources/webgoat/static/main_new.html)
1. Add the parts for showing the flag and providing the correct value for the flag= parameter
2.
2. Add a flag image to src/main/resources/webgoat/static/css/img
1. See the main_new.html for a link to download flag resources
3. Add a welcome page to the introduction lesson
1. Copy Introduction_.adoc to Introduction_es.adoc (if in this case you want to add Spanish)
2. Add a highlighted section that explains that most parts of WebGoat will still be in English and invite people to translate parts where it would be valuable
4. Translate the main labels
1. Copy messages.properties to messages_es.properties (if in this case you want to add Spanish)
2. Translate the label values
5. Optionally translate lessons by
1. Adding lang specifc adoc files in documentation folder of the lesson
2. Adding WebGoatLabels.properties of a specific language if you want to
6. Run mvn clean to see if the LabelAndHintIntegration test passes
7. Run WebGoat and verify that your own language and the other languages work as expected
If you only want to translate more for a certain language, you only need to do step 4-8

290
RELEASE_NOTES.md Normal file
View File

@ -0,0 +1,290 @@
# WebGoat release notes
## Version 2025.1
### 🚀 New functionality
- Introduce Playwright for UI testing
- Refactoring of core code
### 🐞 Bug fixes
- Introduce assignment progress (#2043)
- Add test case for multiple users solving lessons (#2043)
- Register user while already logged in as other user. (#2042)
- Small updates and improvements in HTTP Basic lesson (#2024)
- Improve HTTP basics lesson
- Solve compiler warnings
- Cleanup attack result and builder
- Format all code according to SPDX
- Fixed one invalid solution about CSRF attack (#2010)
- Reset a lesson no longer removes all assignments
- Hint labels showing default text regardless of localization (#1965)
- Automatically solve XSS mitigation (#1957)
- Remove implicit context path guessing (#1956)
- JWT kid/jku lessons (#1949)
- Fix password reset lesson (#1941)
- Fix passing command line arguments (#1933)
- Use banners correctly
- Show boolean operators priority on `where` (#1902)
- Remove WebGoat session object (#1929)
- Reset form and quiz color on reset lesson (#1903)
- XSS lesson typo
- Copying file using `transferTo` sometimes fails. (#1862)
- Fix report card (#1845)
- Success if only Smith earn most salary (#1744)
- Update HttpBasics_plan.adoc - fix broken link to https://www.zaproxy.org/ (#1803)
- Move CSRF to A3 (#1776)
- Fix typo in SQLi blind case
- Use $ instead of jQuery which is undefined (#1736)
- Fix hidden links in MissingFunctionAC.html. (#1710)
### 🔄 Technical tasks
- Lots of dependency updates
## Contributors
Special thanks to the following contributors providing us with a pull request:
- François Capon
- GoogTech HackHuang
- Peter Potrowl
- cap-dev0x
- Benjamin Mouncer
- Jeong Rok Suh
- Rui Melo
- Vandeputte Brice
## Version 2023.8
### 🚀 New functionality
- Consistent environment values and url references (#1677)
- Show directly requested file in requests overview
- Show creating time in file upload overview
### 🐞 Bug fixes
- Fix startup message (#1687)
- Fix/state of software supply chain links (#1683)
- Fix WebWolf UI (#1686)
### 🔄 Technical tasks
- bump actions/setup-java from 3 to 4 (#1690)
- bump commons-io:commons-io from 2.14.0 to 2.15.1 (#1689)
- bump com.diffplug.spotless:spotless-maven-plugin (#1688)
## Version 2023.5
### New functionality
- Implement JWT jku example (#1552)
- Java 21 initial support (#1622)
- improve MFAC lesson hint texts for a better user experience (#1424)
- upgrade to Spring Boot version 3 (#1477)
### Bug fixes
- typo in WebGoad.txt (#1667)
- search box moved and jwt encode/decode with little delay (#1664)
- skip validation for JWT (#1663)
- fixed issue in JWT test tool and added robot test (#1658)
- Password reset link test condition more strict and move all WebWolf links to /WebWolf (#1645)
- fix servers id (#1619)
- potential NPE in the stored XSS assignment
- crypto basics broken links
- fixes the default change in trailing slash matching and address the affected assignments
- hint that was breaking the template, causing hints from different assignments to mix (#1424)
- HijackSession lesson template deprecated Tymeleaf attribute
- Fix NPE in IDOR lesson
- Add new assignment IT tests
- XSS mitigation
- Stored Cross-Site Scripting Lesson
- Add Assignment7 Tests
- Fix IDOR lesson
- remove steps from release script (#1509)
- robotframework fails due to updated dependencies (#1508)
- fix Java image inside Docker file The image now downloads the correct Java version based on the architecture.
- Fix typo of HijackSession_content0.adoc
- Restrict SSRF Regexes
- update challenge code - Flags are now wired through a Spring config - Introduced Flag class - Removed Flags from the
FlagController
## Version 2023.4
### New functionality
- [#1422 Add Docker Linux Desktop variant with all tools installed](https://github.com/WebGoat/WebGoat/issues/1422).
Thanks to the [OWASP WrongSecrets project](https://owasp.org/www-project-wrongsecrets/) we now have a Docker Linux
desktop image with all the tools installed. No need to install any tools locally only run the new Docker image. See
README.md for details on how to start it.
- [#1411 JWT: looks that buy as Tom also works with alg:none](https://github.com/WebGoat/WebGoat/issues/1411).
### Bug fixes
- [#1410 WebWolf: JWT decode is broken](https://github.com/WebGoat/WebGoat/issues/1410).
- [#1396 password_reset return 500 Error](https://github.com/WebGoat/WebGoat/issues/1396).
- [#1379 Move XXE to A05:2021-Security Misconfiguration](https://github.com/WebGoat/WebGoat/issues/1379).
## Version 2023.3
With great pleasure, we present you with a new release of WebGoat **2023.3**. Finally, it has been a while. This year
starts with a new release of WebGoat. This year we will undoubtedly release more often. From this release on, we began
to use a new versioning scheme (https://calver.org/#scheme).
A big thanks to René Zubcevic and Àngel Ollé Blázquez for keeping the project alive this last year, and hopefully, we
can make
many more releases this year.
### New functionality
- New year's resolution(2022): major refactoring of WebGoat to simplify the setup and improve building times.
- Move away from multi-project setup:
* This has a huge performance benefit when building the application. Build time locally is now
`Total time: 42.469 s` (depends on your local machine of course)
* No longer add Maven dependencies in several places
* H2 no longer needs to run as separate process, which solves the issue of WebWolf sharing and needing to configure
the correct database connection.
- More explicit paths in html files to reference `adoc` files, less magic.
- Integrate WebWolf in WebGoat, the setup was way too complicated and needed configuration which could lead to mistakes
and a not working application. This also simplifies the Docker configuration as there is only 1 Docker image.
- Add WebWolf button in WebGoat
- Move all lessons into `src/main/resources`
- WebGoat selects a port dynamically when starting. It will still start of port 8080 it will try another port to ease
the user experience.
- WebGoat logs URL after startup: `Please browse to http://127.0.0.1:8080/WebGoat to get started...`
- Simplify `Dockerfile` as we no longer need a script to start everything
- Maven build now start WebGoat jar with Maven plugin to make sure we run against the latest build.
- Added `Initializable` interface for a lesson, an assignment can implement this interface to set it up for a specific
user and to reset the assignment back to its original state when a reset lesson occurs. See `BlindSendFileAssignment`
for an example.
- Integration tests now use the same user. This saves a lot of time as before every test used a different user which
triggered the Flyway migration to set up the database schema for the user. This migration took a lot of time.
- Updated introduction lesson to WebWolf.
- Added language switch for support for multiple languages.
- Removed logic to start WebGoat on a random port when port `8080` is taken. We would loop until we found a free port.
We simplified this to just start on the specified port.
- Add Google formatter for all our code, a PR now checks whether the code adheres to the standard.
- Renaming of all packages and folders.
- [#1039 New OWASP Top 10](https://github.com/WebGoat/WebGoat/issues/1093)
- [#1065 New lesson about logging](https://github.com/WebGoat/WebGoat/issues/1065)
### Bug fixes
- [#1193 Vulnerable component lesson - java.desktop does not "opens java.beans" to unnamed module](https://github.com/WebGoat/WebGoat/issues/1193)
- [#1176 Minor: XXE lesson 12 patch not reset by 'lesson reset' while it IS reset by leaving/returning to lesson](https://github.com/WebGoat/WebGoat/issues/1176)
- [#1134 "Exploiting XStream" assignment does not work](https://github.com/WebGoat/WebGoat/issues/1134)
- [#1130 Typo: Using Indrect References](https://github.com/WebGoat/WebGoat/issues/1130)
- [#1101 SQL lesson not correct](https://github.com/WebGoat/WebGoat/issues/1101)
- [#1079 startup.sh issues of WebWolf - cannot connect to the WebGoat DB](https://github.com/WebGoat/WebGoat/issues/1079)
- [#1379 Move XXE to A05:2021-_Security_ Misconfiguration](https://github.com/WebGoat/WebGoat/issues/1379)
- [#1298 SocketUtils is deprecated and will be removed in Spring Security 6](https://github.com/WebGoat/WebGoat/issues/1298)
- [#1248 Rewrite the WebWolf Introduction Lesson with the new changes](https://github.com/WebGoat/WebGoat/issues/1248)
- [#1200 Type cast error in sample code at JWT token section](https://github.com/WebGoat/WebGoat/issues/1200)
- [#1173 --server.port=9000 is not respected on Windows (both cmd as Powershell)](https://github.com/WebGoat/WebGoat/issues/1173)
- [#1103 (A1) path traversel lesson 7 seems broken](https://github.com/WebGoat/WebGoat/issues/1103)
- [#986 - User registration not persistant](https://github.com/WebGoat/WebGoat/issues/986)
## Version 8.2.2
### New functionality
- Docker image now supports nginx when browsing to http://localhost a landing page is shown.
### Bug fixes
- [#1039 jwt-7-Code review](https://github.com/WebGoat/WebGoat/issues/1039)
- [#1031 SQL Injection (intro) 5: Data Control Language (DCL) the wiki's solution is not correct](https://github.com/WebGoat/WebGoat/issues/1031)
- [#1027 Webgoat 8.2.1 Vulnerable_Components_12 Shows internal server error](https://github.com/WebGoat/WebGoat/issues/1027)
## Version 8.2.1
### New functionality
- New Docker image for arm64 architecture is now available (for Apple M1)
## Version 8.2.0
### New functionality
- Add new zip slip lesson (part of path traversal)
- SQL lessons are now separate for each user, database are now per user and no longer shared across users
- Moved to Java 15 & Spring Boot 2.4 & moved to JUnit 5
### Bug fixes
- [#974 SQL injection Intro 5 not solvable](https://github.com/WebGoat/WebGoat/issues/974)
- [#962 SQL-Lesson 5 (Advanced) Solvable with wrong anwser](https://github.com/WebGoat/WebGoat/issues/962)
- [#961 SQl-Injection lesson 4 not deleting created row](https://github.com/WebGoat/WebGoat/issues/961)
- [#949 Challenge: Admin password reset always solvable](https://github.com/WebGoat/WebGoat/issues/949)
- [#923 - Upgrade to Java 15](https://github.com/WebGoat/WebGoat/issues/923)
- [#922 - Vulnerable components lesson](https://github.com/WebGoat/WebGoat/issues/922)
- [#891 - Update the OWASP website with the new all-in-one Docker container](https://github.com/WebGoat/WebGoat/issues/891)
- [#844 - Suggestion: Update navigation](https://github.com/WebGoat/WebGoat/issues/844)
- [#843 - Bypass front-end restrictions: Field restrictions - confusing text in form](https://github.com/WebGoat/WebGoat/issues/843)
- [#841 - XSS - Reflected XSS confusing instruction and success messages](https://github.com/WebGoat/WebGoat/issues/841)
- [#839 - SQL Injection (mitigation) Order by clause confusing](https://github.com/WebGoat/WebGoat/issues/839)
- [#838 - SQL mitigation (filtering) can only be passed by updating table](https://github.com/WebGoat/WebGoat/issues/838)
## Contributors
Special thanks to the following contributors providing us with a pull request:
- nicholas-quirk
- VijoPlays
- aolle
- trollingHeifer
- maximmasiutin
- toshihue
- avivmu
- KellyMarchewa
- NatasG
- gabe-sky
## Version 8.1.0
### New functionality
- Added new lessons for cryptography and path-traversal
- Extra content added to the XXE lesson
- Explanation of the assignments will be part of WebGoat, in this release we added detailed descriptions on how to solve
the XXE lesson. In the upcoming releases new explanations will be added. If you want to contribute please create a
pull request on Github.
- Docker improvements + docker stack for complete container with nginx
- Included JWT token decoding and generation, since jwt.io does not support None anymore
### Bug fixes
- [#743 - Character encoding errors](https://github.com/WebGoat/WebGoat/issues/743)
- [#811 - Flag submission fails](https://github.com/WebGoat/WebGoat/issues/811)
- [#810 - Scoreboard for challenges shows csrf users](https://github.com/WebGoat/WebGoat/issues/810)
- [#788 - strange copy in constructor](https://github.com/WebGoat/WebGoat/issues/788)
- [#760 - Execution of standalone jar fails (Flyway migration step](https://github.com/WebGoat/WebGoat/issues/760)
- [#766 - Unclear objective of vulnerable components practical assignment](https://github.com/WebGoat/WebGoat/issues/766)
- [#708 - Seems like the home directory of WebGoat always use @project.version@](https://github.com/WebGoat/WebGoat/issues/708)
- [#719 - WebGoat: 'Contact Us' email link in header is not correctly set](https://github.com/WebGoat/WebGoat/issues/719)
- [#715 - Reset lesson doesn't reset the "HTML lesson" => forms stay succesful](https://github.com/WebGoat/WebGoat/issues/715)
- [#725 - Vulnerable Components lesson 12 broken due to too new dependency](https://github.com/WebGoat/WebGoat/issues/725)
- [#716 - On M26 @project.version@ is not "interpreted" #7](https://github.com/WebGoat/WebGoat/issues/716)
- [#721 couldn't be able to run CSRF lesson 3: Receive Whitelabel Error Page](https://github.com/WebGoat/WebGoat/issues/721)
- [#724 - Dead link in VulnerableComponents lesson 11](https://github.com/WebGoat/WebGoat/issues/724)
## Contributors
Special thanks to the following contributors providing us with a pull request:
- Satoshi SAKAO
- Philippe Lafoucrière
- Cotonne
- Tiago Mussi
- thegoodcrumpets
- Atharva Vaidya
- torleif
- August Detlefsen
- Choe Hyeong Jin
And everyone who provided feedback through Github.
Team WebGoat

View File

@ -1,12 +0,0 @@
version: 0.1
phases:
build:
commands:
- mvn package
artifacts:
files:
- webgoat-server/target/webgoat-server-8.0-SNAPSHOT.jar
discard-paths: yes

259
config/checkstyle/checkstyle.xml Executable file
View File

@ -0,0 +1,259 @@
<?xml version="1.0"?>
<!DOCTYPE module PUBLIC
"-//Puppy Crawl//DTD Check Configuration 1.3//EN"
"http://checkstyle.sourceforge.net/dtds/configuration_1_3.dtd">
<!--
Checkstyle configuration that checks the Google coding conventions from Google Java Style
that can be found at https://google.github.io/styleguide/javaguide.html.
Checkstyle is very configurable. Be sure to read the documentation at
http://checkstyle.sf.net (or in your downloaded distribution).
To completely disable a check, just comment it out or delete it from the file.
Authors: Max Vetrenko, Ruslan Diachenko, Roman Ivanov.
-->
<module name="Checker">
<property name="charset" value="UTF-8"/>
<property name="severity" value="error"/>
<property name="fileExtensions" value="java, properties, xml"/>
<!-- Checks for whitespace -->
<!-- See http://checkstyle.sf.net/config_whitespace.html -->
<module name="SuppressionFilter">
<property name="file" value="${suppressionsLocation}" default="target/checkstyle-suppressions.xml"/>
</module>
<module name="TreeWalker">
<module name="com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck">
<property name="maximum" value="0"/>
<property name="format" value="org\.junit\.Assert\.assert"/>
<property name="message"
value="Please use AssertJ imports."/>
<property name="ignoreComments" value="true"/>
</module>
<module
name="com.puppycrawl.tools.checkstyle.checks.imports.IllegalImportCheck">
<property name="regexp" value="true"/>
<property name="illegalPkgs"
value="^sun.*, ^org\.apache\.commons\.(?!compress|dbcp2|lang|lang3|logging|io|pool2).*, ^org\.flywaydb\.core\.internal.*, ^org\.testcontainers\.shaded.*"/>
<property name="illegalClasses"
value="^com\.hazelcast\.util\.Base64, ^org\.junit\.rules\.ExpectedException, ^org\.slf4j\.LoggerFactory, ^reactor\.core\.support\.Assert, ^com\.google\.common\.collect\.Maps, ^com\.google\.common\.collect\.Sets, ^com\.google\.common\.collect\.Lists"/>
</module>
<module
name="com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck">
<property name="maximum" value="0"/>
<property name="format"
value="assertThatExceptionOfType\((NullPointerException|IllegalArgumentException|IOException|IllegalStateException)\.class\)"/>
<property name="message"
value="Please use specialized AssertJ assertThat*Exception method."/>
<property name="ignoreComments" value="true"/>
</module>
<module
name="com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck">
<property name="maximum" value="0"/>
<property name="format"
value="@SneakyThrows"/>
<property name="message"
value="Please use a unchecked exceptions instead of @SneakyThrows gives compiler warnings"/>
<property name="ignoreComments" value="true"/>
</module>
<module name="OuterTypeFilename"/>
<module name="IllegalTokenText">
<property name="tokens" value="STRING_LITERAL, CHAR_LITERAL"/>
<property name="format"
value="\\u00(09|0(a|A)|0(c|C)|0(d|D)|22|27|5(C|c))|\\(0(10|11|12|14|15|42|47)|134)"/>
<property name="message"
value="Consider using special escape sequence instead of octal value or Unicode escaped value."/>
</module>
<module name="AvoidEscapedUnicodeCharacters">
<property name="allowEscapesForControlCharacters" value="true"/>
<property name="allowByTailComment" value="true"/>
<property name="allowNonPrintableEscapes" value="true"/>
</module>
<module name="OneTopLevelClass">
<property name="severity" value="warning"/>
</module>
<module name="NoLineWrap"/>
<module name="EmptyBlock">
<property name="option" value="TEXT"/>
<property name="tokens" value="LITERAL_TRY, LITERAL_FINALLY, LITERAL_IF, LITERAL_ELSE, LITERAL_SWITCH"/>
</module>
<module name="WhitespaceAround">
<property name="allowEmptyConstructors" value="true"/>
<property name="allowEmptyMethods" value="true"/>
<property name="allowEmptyTypes" value="true"/>
<property name="allowEmptyLoops" value="true"/>
<message key="ws.notFollowed"
value="WhitespaceAround: ''{0}'' is not followed by whitespace. Empty blocks may only be represented as '{}' when not part of a multi-block statement (4.1.3)"/>
<message key="ws.notPreceded"
value="WhitespaceAround: ''{0}'' is not preceded with whitespace."/>
</module>
<module name="OneStatementPerLine"/>
<module name="MultipleVariableDeclarations"/>
<module name="ArrayTypeStyle"/>
<module name="MissingSwitchDefault"/>
<module name="FallThrough"/>
<module name="UpperEll"/>
<module name="ModifierOrder"/>
<module name="EmptyLineSeparator">
<property name="allowNoEmptyLineBetweenFields" value="true"/>
</module>
<module name="SeparatorWrap">
<property name="id" value="SeparatorWrapDot"/>
<property name="tokens" value="DOT"/>
<property name="option" value="nl"/>
</module>
<module name="SeparatorWrap">
<property name="id" value="SeparatorWrapComma"/>
<property name="tokens" value="COMMA"/>
<property name="option" value="EOL"/>
</module>
<module name="SeparatorWrap">
<!-- ELLIPSIS is EOL until https://github.com/google/styleguide/issues/258 -->
<property name="id" value="SeparatorWrapEllipsis"/>
<property name="tokens" value="ELLIPSIS"/>
<property name="option" value="EOL"/>
</module>
<module name="SeparatorWrap">
<!-- ARRAY_DECLARATOR is EOL until https://github.com/google/styleguide/issues/259 -->
<property name="id" value="SeparatorWrapArrayDeclarator"/>
<property name="tokens" value="ARRAY_DECLARATOR"/>
<property name="option" value="EOL"/>
</module>
<module name="SeparatorWrap">
<property name="id" value="SeparatorWrapMethodRef"/>
<property name="tokens" value="METHOD_REF"/>
<property name="option" value="nl"/>
</module>
<module name="PackageName">
<property name="format" value="^[a-z]+(\.[a-z_][a-z0-9_]*)*$"/>
<message key="name.invalidPattern"
value="Package name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="TypeName">
<message key="name.invalidPattern"
value="Type name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="MemberName">
<property name="format" value="^[a-z][a-z0-9][a-zA-Z0-9]*$"/>
<message key="name.invalidPattern"
value="Member name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="ParameterName">
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9_]*)?$"/>
<message key="name.invalidPattern"
value="Parameter name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="CatchParameterName">
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9]*)?$"/>
<message key="name.invalidPattern"
value="Catch parameter name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="LocalVariableName">
<property name="tokens" value="VARIABLE_DEF"/>
<property name="format" value="^[a-z]([a-z0-9][a-zA-Z0-9]*)?$"/>
<message key="name.invalidPattern"
value="Local variable name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="ClassTypeParameterName">
<property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
<message key="name.invalidPattern"
value="Class type name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="MethodTypeParameterName">
<property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
<message key="name.invalidPattern"
value="Method type name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="InterfaceTypeParameterName">
<property name="format" value="(^[A-Z][0-9]?)$|([A-Z][a-zA-Z0-9]*[T]$)"/>
<message key="name.invalidPattern"
value="Interface type name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="NoFinalizer"/>
<module name="GenericWhitespace">
<message key="ws.followed"
value="GenericWhitespace ''{0}'' is followed by whitespace."/>
<message key="ws.preceded"
value="GenericWhitespace ''{0}'' is preceded with whitespace."/>
<message key="ws.illegalFollow"
value="GenericWhitespace ''{0}'' should followed by whitespace."/>
<message key="ws.notPreceded"
value="GenericWhitespace ''{0}'' is not preceded with whitespace."/>
</module>
<module name="AbbreviationAsWordInName">
<property name="ignoreFinal" value="false"/>
<property name="allowedAbbreviationLength" value="4"/>
<property name="severity" value="warning"/>
</module>
<module name="OverloadMethodsDeclarationOrder"/>
<module name="VariableDeclarationUsageDistance"/>
<module name="CustomImportOrder">
<property name="sortImportsInGroupAlphabetically" value="false"/>
<property name="separateLineBetweenGroups" value="true"/>
<property name="customImportOrderRules" value="THIRD_PARTY_PACKAGE###STATIC"/>
</module>
<module name="MethodParamPad"/>
<module name="NoWhitespaceBefore">
<property name="tokens" value="COMMA, SEMI, POST_INC, POST_DEC, DOT, ELLIPSIS, METHOD_REF"/>
<property name="allowLineBreaks" value="true"/>
</module>
<module name="ParenPad"/>
<module name="OperatorWrap">
<property name="option" value="NL"/>
<property name="tokens"
value="BAND, BOR, BSR, BXOR, DIV, EQUAL, GE, GT, LAND, LE, LITERAL_INSTANCEOF, LOR, LT, MINUS, MOD, NOT_EQUAL, PLUS, QUESTION, SL, SR, STAR, METHOD_REF "/>
</module>
<module name="AnnotationLocation">
<property name="id" value="AnnotationLocationMostCases"/>
<property name="tokens" value="CLASS_DEF, INTERFACE_DEF, ENUM_DEF, METHOD_DEF, CTOR_DEF"/>
</module>
<module name="AnnotationLocation">
<property name="id" value="AnnotationLocationVariables"/>
<property name="tokens" value="VARIABLE_DEF"/>
<property name="allowSamelineMultipleAnnotations" value="true"/>
</module>
<module name="NonEmptyAtclauseDescription"/>
<module name="JavadocTagContinuationIndentation"/>
<module name="SummaryJavadoc">
<property name="forbiddenSummaryFragments"
value="^@return the *|^This method returns |^A [{]@code [a-zA-Z0-9]+[}]( is a )"/>
<property name="severity" value="warning"/>
</module>
<module name="JavadocParagraph">
<property name="severity" value="warning"/>
</module>
<module name="AtclauseOrder">
<property name="tagOrder" value="@param, @return, @throws, @deprecated"/>
<property name="target" value="CLASS_DEF, INTERFACE_DEF, ENUM_DEF, METHOD_DEF, CTOR_DEF, VARIABLE_DEF"/>
<property name="severity" value="warning"/>
</module>
<module name="JavadocMethod">
<property name="tokens" value="CLASS_DEF,INTERFACE_DEF,ENUM_DEF,METHOD_DEF,ANNOTATION_FIELD_DEF"/>
<property name="scope" value="public"/>
<property name="allowMissingParamTags" value="true"/>
<property name="allowMissingThrowsTags" value="true"/>
<property name="allowMissingReturnTag" value="true"/>
<property name="minLineCount" value="2"/>
<property name="allowedAnnotations" value="Override, Test"/>
<property name="allowThrowsTagsForSubclasses" value="true"/>
<property name="severity" value="warning"/>
</module>
<module name="MethodName">
<property name="format" value="^[a-z][a-z0-9][a-zA-Z0-9_]*$"/>
<message key="name.invalidPattern"
value="Method name ''{0}'' must match pattern ''{1}''."/>
</module>
<module name="SingleLineJavadoc">
<property name="ignoreInlineTags" value="false"/>
</module>
<module name="EmptyCatchBlock">
<property name="exceptionVariableName" value="expected"/>
</module>
<module name="CommentsIndentation"/>
</module>
</module>

View File

@ -0,0 +1,11 @@
<?xml version="1.0"?>
<!DOCTYPE suppressions PUBLIC
"-//Checkstyle//DTD SuppressionFilter Configuration 1.2//EN"
"https://checkstyle.org/dtds/suppressions_1_2.dtd">
<suppressions>
<suppress files="MD5.java" checks="[a-zA-Z0-9]*" />
<suppress files="VulnerableComponentsLesson.java" checks="[a-zA-Z0-9]*" />
<suppress files="ContentTypeAssignment.java" checks="IllegalImportCheck" />
<suppress files="SimpleXXE.java" checks="IllegalImportCheck" />
<suppress files="HtmlTamperingTask.java" checks="ParameterName" />
</suppressions>

View File

@ -0,0 +1,77 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress>
<notes><![CDATA[
This suppresses all CVE entries that have a score below CVSS 7.
]]></notes>
<cvssBelow>7</cvssBelow>
</suppress>
<suppress>
<notes><![CDATA[
file name: spring-tx-5.3.21.jar
]]></notes>
<sha1>13f4f564024d2f85502c151942307c3ca851a4f7</sha1>
<cve>CVE-2016-1000027</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: spring-core-5.3.21.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-core@.*$</packageUrl>
<cve>CVE-2016-1000027</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: spring-aop-5.3.21.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-aop@.*$</packageUrl>
<cve>CVE-2016-1000027</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: spring-boot-starter-security-2.7.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.boot/spring\-boot\-starter\-security@.*$</packageUrl>
<cve>CVE-2022-22978</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: jruby-stdlib-9.2.20.1.jar: jopenssl.jar (shaded: rubygems:jruby-openssl:0.11.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/rubygems/jruby\-openssl@.*$</packageUrl>
<cpe>cpe:/a:jruby:jruby</cpe>
<cpe>cpe:/a:openssl:openssl</cpe>
</suppress>
<suppress>
<notes><![CDATA[
file name: xstream-1.4.5.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.thoughtworks\.xstream/xstream@.*$</packageUrl>
<cpe>cpe:/a:xstream_project:xstream</cpe>
<vulnerabilityName>CVE-2013-7285</vulnerabilityName>
<vulnerabilityName>CVE-2016-3674</vulnerabilityName>
<vulnerabilityName>CVE-2017-7957</vulnerabilityName>
<vulnerabilityName>CVE-2020-26217</vulnerabilityName>
<vulnerabilityName>CVE-2020-26258</vulnerabilityName>
<vulnerabilityName>CVE-2020-26259</vulnerabilityName>
<vulnerabilityName>CVE-2021-21341</vulnerabilityName>
<vulnerabilityName>CVE-2021-21342</vulnerabilityName>
<vulnerabilityName>CVE-2021-21343</vulnerabilityName>
<vulnerabilityName>CVE-2021-21344</vulnerabilityName>
<vulnerabilityName>CVE-2021-21345</vulnerabilityName>
<vulnerabilityName>CVE-2021-21346</vulnerabilityName>
<vulnerabilityName>CVE-2021-21347</vulnerabilityName>
<vulnerabilityName>CVE-2021-21348</vulnerabilityName>
<vulnerabilityName>CVE-2021-21349</vulnerabilityName>
<vulnerabilityName>CVE-2021-21350</vulnerabilityName>
<vulnerabilityName>CVE-2021-21351</vulnerabilityName>
<vulnerabilityName>CVE-2021-43859</vulnerabilityName>
</suppress>
<suppress>
<notes><![CDATA[
file name: spring-jcl-5.3.21.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-.*@.*$</packageUrl>
<cve>CVE-2016-1000027</cve>
</suppress>
</suppressions>

View File

@ -0,0 +1,10 @@
** Welcome to WebGoat desktop image
With this image you have WebGoat and ZAP and a browser available to you in a browser running on Ubuntu.
You can start WebGoat and ZAP by opening a terminal and type:
./start_webgoat.sh
./start_zap.sh
Happy hacking,
Team WebGoat

View File

@ -0,0 +1,17 @@
#!/bin/sh
/config/java-jdk/bin/java \
-Duser.home=/config \
-Dfile.encoding=UTF-8 \
-DTZ=Europe/Amsterdam \
--add-opens java.base/java.lang=ALL-UNNAMED \
--add-opens java.base/java.util=ALL-UNNAMED \
--add-opens java.base/java.lang.reflect=ALL-UNNAMED \
--add-opens java.base/java.text=ALL-UNNAMED \
--add-opens java.desktop/java.beans=ALL-UNNAMED \
--add-opens java.desktop/java.awt.font=ALL-UNNAMED \
--add-opens java.base/sun.nio.ch=ALL-UNNAMED \
--add-opens java.base/java.io=ALL-UNNAMED \
--add-opens java.base/java.util=ALL-UNNAMED \
-Drunning.in.docker=false \
-jar /config/webgoat.jar

View File

@ -0,0 +1,3 @@
#!/bin/sh
/config/java-jdk/bin/java -jar /config/ZAP_2.15.0/zap-2.15.0.jar

View File

@ -0,0 +1,4 @@
/*
* SPDX-FileCopyrightText: Copyright © $today.year WebGoat authors
* SPDX-License-Identifier: GPL-2.0-or-later
*/

View File

@ -1,13 +0,0 @@
version: '2.1'
services:
webgoat:
image: webgoat/webgoat-v8.0.0.snapshot
extends:
file: docker-compose.yml
service: webgoat
webwolf:
extends:
file: docker-compose.yml
service: webwolf
image: webgoat/webwolf-v8.0.0.snapshot

View File

@ -1,40 +0,0 @@
version: '2.0'
services:
webgoat:
image: webgoat/webgoat-8.0
user: webgoat
environment:
- WEBWOLF_HOST=webwolf
- WEBWOLF_PORT=9090
- spring.datasource.url=jdbc:postgresql://webgoat_db:5432/webgoat
- spring.datasource.username=webgoat
- spring.datasource.password=webgoat
- spring.datasource.driver-class-name=org.postgresql.Driver
- spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQL94Dialect
- webgoat.server.directory=/home/webgoat/.webgoat/
- webgoat.user.directory=/home/webgoat/.webgoat/
ports:
- "8080:8080"
webwolf:
image: webgoat/webwolf
environment:
- spring.datasource.url=jdbc:postgresql://webgoat_db:5432/webgoat
- spring.datasource.username=webgoat
- spring.datasource.password=webgoat
- spring.datasource.driver-class-name=org.postgresql.Driver
- spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.PostgreSQL94Dialect
ports:
- "9090:9090"
webgoat_db:
image: postgres:9.4
# Uncomment to store the state of the database on the host.
# volumes:
# - ./database:/var/lib/postgresql
environment:
- POSTGRES_PASSWORD=webgoat
- POSTGRES_USER=webgoat
- POSTGRES_DB=webgoat
ports:
- "5432:5432"

View File

@ -1,18 +0,0 @@
version: '2.1'
services:
webgoat:
image: webgoat/webgoat-8.0
environment:
- WEBWOLF_HOST=webwolf
- WEBWOLF_PORT=9090
ports:
- "8080:8080"
- "9001:9001"
volumes:
- .:/home/webgoat/.webgoat
webwolf:
image: webgoat/webwolf
ports:
- "9090:9090"
command: --spring.datasource.url=jdbc:hsqldb:hsql://webgoat:9001/webgoat --server.address=0.0.0.0

View File

@ -1,21 +0,0 @@
The MIT License (MIT)
Copyright (c) 2013-2019 Blackrock Digital LLC
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.

View File

@ -1,20 +1,3 @@
# WebGoat landing page
This serves the Github pages for the landing page of WebGoat.
# Running locally
```
docker run -t --rm -v "$PWD":/usr/src/app -p "4000:4000" starefossen/github-pages
```
And then browse to http://localhost:4000/docs
# Thanks to
[Freelancer](http://startbootstrap.com/template-overviews/freelancer/) is a one page freelancer portfolio theme for [Bootstrap](http://getbootstrap.com/) created by [Start Bootstrap](http://startbootstrap.com/). This theme features several content sections, a responsive portfolio grid with hover effects, full page portfolio item modals, and a working PHP contact form.
## Copyright and License
Copyright 2013-2018 Blackrock Digital LLC. Code released under the [MIT](https://github.com/BlackrockDigital/startbootstrap-freelancer/blob/gh-pages/LICENSE) license.
Old GitHub page which now redirects to OWASP website.

View File

@ -1,380 +0,0 @@
body {
font-family: 'Lato';
}
h1,
h2,
h3,
h4,
h5,
h6 {
font-weight: 700;
font-family: 'Montserrat';
}
hr.star-light,
hr.star-dark {
max-width: 15rem;
padding: 0;
text-align: center;
border: none;
border-top: solid 0.25rem;
margin-top: 2.5rem;
margin-bottom: 2.5rem;
}
hr.star-light:after,
hr.star-dark:after {
position: relative;
top: -.8em;
display: inline-block;
padding: 0 0.25em;
content: '\f005';
font-family: FontAwesome;
font-size: 2em;
}
hr.star-light {
border-color: #fff;
}
hr.star-light:after {
color: #fff;
background-color: #18BC9C;
}
hr.star-dark {
border-color: #2C3E50;
}
hr.star-dark:after {
color: #2C3E50;
background-color: white;
}
section {
padding: 6rem 0;
}
section h2 {
font-size: 2.25rem;
line-height: 2rem;
}
@media (min-width: 992px) {
section h2 {
font-size: 3rem;
line-height: 2.5rem;
}
}
.btn-xl {
padding: 1rem 1.75rem;
font-size: 1.25rem;
}
.btn-social {
width: 3.25rem;
height: 3.25rem;
font-size: 1.25rem;
line-height: 2rem;
}
.scroll-to-top {
z-index: 1042;
right: 1rem;
bottom: 1rem;
display: none;
}
.scroll-to-top a {
width: 3.5rem;
height: 3.5rem;
background-color: rgba(33, 37, 41, 0.5);
line-height: 3.1rem;
}
#mainNav {
padding-top: 1rem;
padding-bottom: 1rem;
font-weight: 700;
font-family: 'Montserrat';
}
#mainNav .navbar-brand {
color: #fff;
}
#mainNav .navbar-nav {
margin-top: 1rem;
letter-spacing: 0.0625rem;
}
#mainNav .navbar-nav li.nav-item a.nav-link {
color: #fff;
}
#mainNav .navbar-nav li.nav-item a.nav-link:hover {
color: #18BC9C;
}
#mainNav .navbar-nav li.nav-item a.nav-link:active, #mainNav .navbar-nav li.nav-item a.nav-link:focus {
color: #fff;
}
#mainNav .navbar-nav li.nav-item a.nav-link.active {
color: #18BC9C;
}
#mainNav .navbar-toggler {
font-size: 80%;
padding: 0.8rem;
}
@media (min-width: 992px) {
#mainNav {
padding-top: 1.5rem;
padding-bottom: 1.5rem;
-webkit-transition: padding-top 0.3s, padding-bottom 0.3s;
-moz-transition: padding-top 0.3s, padding-bottom 0.3s;
transition: padding-top 0.3s, padding-bottom 0.3s;
}
#mainNav .navbar-brand {
font-size: 2em;
-webkit-transition: font-size 0.3s;
-moz-transition: font-size 0.3s;
transition: font-size 0.3s;
}
#mainNav .navbar-nav {
margin-top: 0;
}
#mainNav .navbar-nav > li.nav-item > a.nav-link.active {
color: #fff;
background: #18BC9C;
}
#mainNav .navbar-nav > li.nav-item > a.nav-link.active:active, #mainNav .navbar-nav > li.nav-item > a.nav-link.active:focus, #mainNav .navbar-nav > li.nav-item > a.nav-link.active:hover {
color: #fff;
background: #18BC9C;
}
#mainNav.navbar-shrink {
padding-top: 0.5rem;
padding-bottom: 0.5rem;
}
#mainNav.navbar-shrink .navbar-brand {
font-size: 1.5em;
}
}
header.masthead {
padding-top: calc(6rem + 72px);
padding-bottom: 6rem;
}
header.masthead h1 {
font-size: 3rem;
line-height: 3rem;
}
header.masthead h2 {
font-size: 1.3rem;
font-family: 'Lato';
}
@media (min-width: 992px) {
header.masthead {
padding-top: calc(6rem + 106px);
padding-bottom: 6rem;
}
header.masthead h1 {
font-size: 4.75em;
line-height: 4rem;
}
header.masthead h2 {
font-size: 1.75em;
}
}
.portfolio {
margin-bottom: -15px;
}
.portfolio .portfolio-item {
position: relative;
display: block;
max-width: 25rem;
margin-bottom: 15px;
}
.portfolio .portfolio-item .portfolio-item-caption {
-webkit-transition: all ease 0.5s;
-moz-transition: all ease 0.5s;
transition: all ease 0.5s;
opacity: 0;
background-color: rgba(24, 188, 156, 0.9);
}
.portfolio .portfolio-item .portfolio-item-caption:hover {
opacity: 1;
}
.portfolio .portfolio-item .portfolio-item-caption .portfolio-item-caption-content {
font-size: 1.5rem;
}
@media (min-width: 576px) {
.portfolio {
margin-bottom: -30px;
}
.portfolio .portfolio-item {
margin-bottom: 30px;
}
}
.portfolio-modal .portfolio-modal-dialog {
padding: 3rem 1rem;
min-height: calc(100vh - 2rem);
margin: 1rem calc(1rem - 8px);
position: relative;
z-index: 2;
-moz-box-shadow: 0 0 3rem 1rem rgba(0, 0, 0, 0.5);
-webkit-box-shadow: 0 0 3rem 1rem rgba(0, 0, 0, 0.5);
box-shadow: 0 0 3rem 1rem rgba(0, 0, 0, 0.5);
}
.portfolio-modal .portfolio-modal-dialog .close-button {
position: absolute;
top: 2rem;
right: 2rem;
}
.portfolio-modal .portfolio-modal-dialog .close-button i {
line-height: 38px;
}
.portfolio-modal .portfolio-modal-dialog h2 {
font-size: 2rem;
}
@media (min-width: 768px) {
.portfolio-modal .portfolio-modal-dialog {
min-height: 100vh;
padding: 5rem;
margin: 3rem calc(3rem - 8px);
}
.portfolio-modal .portfolio-modal-dialog h2 {
font-size: 3rem;
}
}
.floating-label-form-group {
position: relative;
border-bottom: 1px solid #e9ecef;
}
.floating-label-form-group input,
.floating-label-form-group textarea {
font-size: 1.5em;
position: relative;
z-index: 1;
padding-right: 0;
padding-left: 0;
resize: none;
border: none;
border-radius: 0;
background: none;
box-shadow: none !important;
}
.floating-label-form-group label {
font-size: 0.85em;
line-height: 1.764705882em;
position: relative;
z-index: 0;
top: 2em;
display: block;
margin: 0;
-webkit-transition: top 0.3s ease, opacity 0.3s ease;
-moz-transition: top 0.3s ease, opacity 0.3s ease;
-ms-transition: top 0.3s ease, opacity 0.3s ease;
transition: top 0.3s ease, opacity 0.3s ease;
vertical-align: middle;
vertical-align: baseline;
opacity: 0;
}
.floating-label-form-group:not(:first-child) {
padding-left: 14px;
border-left: 1px solid #e9ecef;
}
.floating-label-form-group-with-value label {
top: 0;
opacity: 1;
}
.floating-label-form-group-with-focus label {
color: #18BC9C;
}
form .row:first-child .floating-label-form-group {
border-top: 1px solid #e9ecef;
}
.footer {
padding-top: 5rem;
padding-bottom: 5rem;
background-color: #2C3E50;
color: #fff;
}
.copyright {
background-color: #1a252f;
}
a {
color: #18BC9C;
}
a:focus, a:hover, a:active {
color: #128f76;
}
.btn {
border-width: 2px;
}
.bg-primary {
background-color: #18BC9C !important;
}
.bg-secondary {
background-color: #2C3E50 !important;
}
.text-primary {
color: #18BC9C !important;
}
.text-secondary {
color: #2C3E50 !important;
}
.btn-primary {
background-color: #18BC9C;
border-color: #18BC9C;
}
.btn-primary:hover, .btn-primary:focus, .btn-primary:active {
background-color: #128f76;
border-color: #128f76;
}
.btn-secondary {
background-color: #2C3E50;
border-color: #2C3E50;
}
.btn-secondary:hover, .btn-secondary:focus, .btn-secondary:active {
background-color: #1a252f;
border-color: #1a252f;
}

File diff suppressed because one or more lines are too long

View File

@ -1,137 +0,0 @@
// Load plugins
const autoprefixer = require("gulp-autoprefixer");
const browsersync = require("browser-sync").create();
const cleanCSS = require("gulp-clean-css");
const gulp = require("gulp");
const header = require("gulp-header");
const plumber = require("gulp-plumber");
const rename = require("gulp-rename");
const sass = require("gulp-sass");
const uglify = require("gulp-uglify");
const pkg = require('./package.json');
// Set the banner content
const banner = ['/*!\n',
' * Start Bootstrap - <%= pkg.title %> v<%= pkg.version %> (<%= pkg.homepage %>)\n',
' * Copyright 2013-' + (new Date()).getFullYear(), ' <%= pkg.author %>\n',
' * Licensed under <%= pkg.license %> (https://github.com/BlackrockDigital/<%= pkg.name %>/blob/master/LICENSE)\n',
' */\n',
'\n'
].join('');
// Copy third party libraries from /node_modules into /vendor
gulp.task('vendor', function(cb) {
// Bootstrap
gulp.src([
'./node_modules/bootstrap/dist/**/*',
'!./node_modules/bootstrap/dist/css/bootstrap-grid*',
'!./node_modules/bootstrap/dist/css/bootstrap-reboot*'
])
.pipe(gulp.dest('./vendor/bootstrap'))
// Font Awesome
gulp.src([
'./node_modules/@fortawesome/**/*',
])
.pipe(gulp.dest('./vendor'))
// jQuery
gulp.src([
'./node_modules/jquery/dist/*',
'!./node_modules/jquery/dist/core.js'
])
.pipe(gulp.dest('./vendor/jquery'))
// jQuery Easing
gulp.src([
'./node_modules/jquery.easing/*.js'
])
.pipe(gulp.dest('./vendor/jquery-easing'))
// Magnific Popup
gulp.src([
'./node_modules/magnific-popup/dist/*'
])
.pipe(gulp.dest('./vendor/magnific-popup'))
cb();
});
// CSS task
function css() {
return gulp
.src("./scss/*.scss")
.pipe(plumber())
.pipe(sass({
outputStyle: "expanded"
}))
.on("error", sass.logError)
.pipe(autoprefixer({
browsers: ['last 2 versions'],
cascade: false
}))
.pipe(header(banner, {
pkg: pkg
}))
.pipe(gulp.dest("./css"))
.pipe(rename({
suffix: ".min"
}))
.pipe(cleanCSS())
.pipe(gulp.dest("./css"))
.pipe(browsersync.stream());
}
// JS task
function js() {
return gulp
.src([
'./js/*.js',
'!./js/*.min.js',
'!./js/contact_me.js',
'!./js/jqBootstrapValidation.js'
])
.pipe(uglify())
.pipe(header(banner, {
pkg: pkg
}))
.pipe(rename({
suffix: '.min'
}))
.pipe(gulp.dest('./js'))
.pipe(browsersync.stream());
}
// Tasks
gulp.task("css", css);
gulp.task("js", js);
// BrowserSync
function browserSync(done) {
browsersync.init({
server: {
baseDir: "./"
}
});
done();
}
// BrowserSync Reload
function browserSyncReload(done) {
browsersync.reload();
done();
}
// Watch files
function watchFiles() {
gulp.watch("./scss/**/*", css);
gulp.watch(["./js/**/*.js", "!./js/*.min.js"], js);
gulp.watch("./**/*.html", browserSyncReload);
}
gulp.task("default", gulp.parallel('vendor', css, js));
// dev task
gulp.task("dev", gulp.parallel(watchFiles, browserSync));

BIN
docs/images/webgoat.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 319 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 46 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 978 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 8.4 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 36 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 17 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 27 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 25 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 483 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 418 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 16 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 19 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 24 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 14 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 4.3 KiB

View File

@ -2,289 +2,13 @@
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<meta name="description" content="WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities
commonly found in Java-based applications that use common and popular open source components">
<meta name="author" content="WebGoat">
<title>WebGoat</title>
<!-- Bootstrap core CSS -->
<link href="vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet">
<!-- Custom fonts for this template -->
<link href="vendor/font-awesome/css/font-awesome.min.css" rel="stylesheet" type="text/css">
<link href="https://fonts.googleapis.com/css?family=Montserrat:400,700" rel="stylesheet" type="text/css">
<link href="https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic" rel="stylesheet" type="text/css">
<!-- Plugin CSS -->
<link href="vendor/magnific-popup/magnific-popup.css" rel="stylesheet" type="text/css">
<!-- Custom styles for this template -->
<link href="css/freelancer.min.css" rel="stylesheet">
<meta http-equiv="refresh" content="0;url=https://owasp.org/www-project-webgoat/" />
<link rel="canonical" href="https://owasp.org/www-project-webgoat/" />
</head>
<body id="page-top">
<!-- Navigation -->
<nav class="navbar navbar-expand-lg bg-secondary fixed-top text-uppercase" id="mainNav">
<div class="container">
<!-- Brand and toggle get grouped for better mobile display -->
<div class="navbar-header page-scroll">
<img class="img-responsive" src="img/profile.png" alt="">
</div>
</div>
</nav>
<!-- Header -->
<header class="masthead bg-primary text-white text-center">
<div class="container">
<div class="row">
<div class="col-lg-12">
<h2 class="text-center text-uppercase mb-5">Learn the hack - Stop the attack</h2>
</div>
</div>
<div class="row">
<div class="col-lg-8 mx-auto">
<p>WebGoat is a deliberately insecure application that allows interested developers just like you to test vulnerabilities
commonly found in Java-based applications that use common and popular open source components.</p>
</div>
<div class="col-lg-8 mx-auto">
<a href="https://github.com/WebGoat/WebGoat/releases" class="btn btn-xl btn-outline-light">
<i class="fa fa-download"></i> Download standalone
</a>
<a href="https://hub.docker.com/r/webgoat/webgoat-8.0/" class="btn btn-xl btn-outline-light">
<i class="fa fa-download"></i> Run using Docker
</a>
</div>
</div>
</div>
</header>
<!-- Portfolio Grid Section -->
<section class="portfolio" id="portfolio">
<div class="container">
<h3 class="text-center text-uppercase text-secondary mb-0">Learn in 3 steps</h3>
<hr class="star-dark mb-5">
<div class="row">
<div class="col-md-6 col-lg-4 text-center">
<a class="portfolio-item d-block mx-auto" href="#portfolio-modal-1">
<div class="portfolio-item-caption d-flex position-absolute h-100 w-100">
<div class="portfolio-item-caption-content my-auto w-100 text-center text-white">
<i class="fa fa-search-plus fa-3x"></i>
</div>
</div>
<img class="img-fluid" src="img/portfolio/teach.png" alt="">
</a>
</div>
<div class="col-md-6 col-lg-4 text-center">
<a class="portfolio-item d-block mx-auto" href="#portfolio-modal-2">
<div class="portfolio-item-caption d-flex position-absolute h-100 w-100">
<div class="portfolio-item-caption-content my-auto w-100 text-center text-white">
<i class="fa fa-search-plus fa-3x"></i>
</div>
</div>
<img class="img-fluid" src="img/portfolio/assignment.png" alt="">
</a>
</div>
<div class="col-md-6 col-lg-4 text-center" >
<a class="portfolio-item d-block mx-auto" href="#portfolio-modal-3">
<div class="portfolio-item-caption d-flex position-absolute h-100 w-100">
<div class="portfolio-item-caption-content my-auto w-100 text-center text-white">
<i class="fa fa-search-plus fa-3x"></i>
</div>
</div>
<img class="img-fluid" src="img/portfolio/mitigation.png" alt="">
</a>
</div>
</div>
</div>
</section>
<!-- Goals Section -->
<section class="bg-primary text-white mb-0" id="goals">
<div class="container">
<h3 class="text-center text-uppercase text-white">Goals</h3>
<hr class="star-light mb-5">
<div class="row">
<div class="col-lg-6 ml-auto">
<p class="lead">
Web application security is difficult to learn and practice. Not many people have full blown web applications like online book
stores or online banks that can be used to scan for vulnerabilities. In addition, security professionals frequently need to test
tools against a platform known to be vulnerable to ensure that they perform as advertised. All of this needs to happen in a safe
and legal environment.
</p>
</div>
<div class="col-lg-6 mr-auto">
<p class="lead">Even if your intentions are good, we believe you should never attempt to find vulnerabilities without
permission. The primary goal of the WebGoat project is simple: create a de-facto interactive teaching environment for web application security.
In the future, the project team hopes to extend WebGoat into becoming a security benchmarking platform and a Java-based Web site Honeypot.
</p>
</div>
</div>
</div>
</section>
<!-- Contributing Section -->
<section class="portfolio" id="portfolio">
<div class="container">
<h3 class="text-center text-uppercase text-secondary mb-0">More information</h3>
<hr class="star-dark mb-5">
<div class="row">
<div class="col-lg-4 ml-auto">
<p class="lead">For more information about running WebGoat / FAQ see our <a href="https://github.com/WebGoat/WebGoat/wiki">wiki pages.</a>
</p>
</div>
<div class="col-lg-4 mr-auto">
<p class="lead">Interested in contributing to WebGoat, take a look at our <a href="https://github.com/WebGoat/WebGoat/issues">issues.</a> </p>
</div>
</div>
</div>
</section>
<!-- Footer -->
<footer class="footer text-center">
<div class="container">
<div class="row">
<div class="col-md-4 mb-5 mb-lg-0">
</div>
<div class="col-md-4 mb-5 mb-lg-0">
<h4 class="text-uppercase mb-4">Around the Web</h4>
<ul class="list-inline mb-0">
<li class="list-inline-item">
<a class="btn btn-outline-light btn-social text-center rounded-circle" href="mailto:webgoat@owasp.org">
<i class="fa fa-fw fa-at"></i>
</a>
</li>
<li class="list-inline-item">
<a class="btn btn-outline-light btn-social text-center rounded-circle" href="https://github.com/WebGoat">
<i class="fa fa-fw fa-github"></i>
</a>
</li>
<li class="list-inline-item">
<a class="btn btn-outline-light btn-social text-center rounded-circle" href="https://stackoverflow.com/search?q=webgoat">
<i class="fa fa-fw fa-stack-overflow"></i>
</a>
</li>
<li class="list-inline-item">
<a class="btn btn-outline-light btn-social text-center rounded-circle" href="https://twitter.com/OWASP_WebGoat">
<i class="fa fa-fw fa-twitter"></i>
</a>
</li>
<li class="list-inline-item">
<a class="btn btn-outline-light btn-social text-center rounded-circle" href="https://owasp.slack.com/messages/#project-webgoat/">
<i class="fa fa-fw fa-slack"></i>
</a>
</li>
</ul>
</div>
</div>
</div>
</footer>
<div class="copyright py-4 text-center text-white">
<div class="container">
<small>Team WebGoat 2019</small>
</div>
</div>
<!-- Scroll to Top Button (Only visible on small and extra-small screen sizes) -->
<div class="scroll-to-top d-lg-none position-fixed ">
<a class="js-scroll-trigger d-block text-center text-white rounded" href="#page-top">
<i class="fa fa-chevron-up"></i>
</a>
</div>
<!-- Explain modal -->
<div class="portfolio-modal mfp-hide" id="portfolio-modal-1">
<div class="portfolio-modal-dialog bg-white">
<a class="close-button d-none d-md-block portfolio-modal-dismiss" href="#">
<i class="fa fa-3x fa-times"></i>
</a>
<div class="container text-center">
<div class="row">
<div class="col-lg-8 mx-auto">
<h3 class="text-secondary text-uppercase mb-0">Explain the vulnerability</h3>
<hr class="star-dark mb-5">
<img class="img-fluid mb-5" src="img/portfolio/lesson.png" alt="">
<p class="mb-5">Teaching is now a first class citizen of WebGoat, we explain explain the vulnerability. Instead of 'just hacking' we now focus on explaining from the beginning what for example a SQL injection is.
</p>
<a class="btn btn-primary btn-lg rounded-pill portfolio-modal-dismiss" href="#">
<i class="fa fa-close"></i>
Close</a>
</div>
</div>
</div>
</div>
</div>
<!-- Assignment modal -->
<div class="portfolio-modal mfp-hide" id="portfolio-modal-2">
<div class="portfolio-modal-dialog bg-white">
<a class="close-button d-none d-md-block portfolio-modal-dismiss" href="#">
<i class="fa fa-3x fa-times"></i>
</a>
<div class="container text-center">
<div class="row">
<div class="col-lg-8 mx-auto">
<h3 class="text-secondary text-uppercase mb-0">Learn by doing</h3>
<hr class="star-dark mb-5">
<img class="img-fluid mb-5" src="img/portfolio/assignment-example.png" alt="">
<p class="mb-5">During the explanation of a vulnerability we build assignments which will help you understand how it works.</p>
<a class="btn btn-primary btn-lg rounded-pill portfolio-modal-dismiss" href="#">
<i class="fa fa-close"></i>
Close</a>
</div>
</div>
</div>
</div>
</div>
<!-- Mitigation modal -->
<div class="portfolio-modal mfp-hide" id="portfolio-modal-3">
<div class="portfolio-modal-dialog bg-white">
<a class="close-button d-none d-md-block portfolio-modal-dismiss" href="#">
<i class="fa fa-3x fa-times"></i>
</a>
<div class="container text-center">
<div class="row">
<div class="col-lg-8 mx-auto">
<h3 class="text-secondary text-uppercase mb-0">Explain mitigations</h3>
<hr class="star-dark mb-5">
<img class="img-fluid mb-5" src="img/portfolio/mitigation-example.png" alt="">
<p class="mb-5">At the end of each lesson you will receive an overview of possible mitigations which will help you during your development work.</p>
<a class="btn btn-primary btn-lg rounded-pill portfolio-modal-dismiss" href="#">
<i class="fa fa-close"></i>
Close</a>
</div>
</div>
</div>
</div>
</div>
<!-- Bootstrap core JavaScript -->
<script src="vendor/jquery/jquery.min.js"></script>
<script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script>
<!-- Plugin JavaScript -->
<script src="vendor/jquery-easing/jquery.easing.min.js"></script>
<script src="vendor/magnific-popup/jquery.magnific-popup.min.js"></script>
<!-- Contact Form JavaScript -->
<script src="js/jqBootstrapValidation.js"></script>
<script src="js/contact_me.js"></script>
<!-- Custom scripts for this template -->
<script src="js/freelancer.min.js"></script>
<body>
<h1>
The page been moved to <a href="https://owasp.org/www-project-webgoat/">https://owasp.org/www-project-webgoat/</a>
</h1>
</body>
</html>

View File

@ -1,75 +0,0 @@
$(function() {
$("#contactForm input,#contactForm textarea").jqBootstrapValidation({
preventSubmit: true,
submitError: function($form, event, errors) {
// additional error messages or events
},
submitSuccess: function($form, event) {
event.preventDefault(); // prevent default submit behaviour
// get values from FORM
var name = $("input#name").val();
var email = $("input#email").val();
var phone = $("input#phone").val();
var message = $("textarea#message").val();
var firstName = name; // For Success/Failure Message
// Check for white space in name for Success/Fail message
if (firstName.indexOf(' ') >= 0) {
firstName = name.split(' ').slice(0, -1).join(' ');
}
$this = $("#sendMessageButton");
$this.prop("disabled", true); // Disable submit button until AJAX call is complete to prevent duplicate messages
$.ajax({
url: "././mail/contact_me.php",
type: "POST",
data: {
name: name,
phone: phone,
email: email,
message: message
},
cache: false,
success: function() {
// Success message
$('#success').html("<div class='alert alert-success'>");
$('#success > .alert-success').html("<button type='button' class='close' data-dismiss='alert' aria-hidden='true'>&times;")
.append("</button>");
$('#success > .alert-success')
.append("<strong>Your message has been sent. </strong>");
$('#success > .alert-success')
.append('</div>');
//clear all fields
$('#contactForm').trigger("reset");
},
error: function() {
// Fail message
$('#success').html("<div class='alert alert-danger'>");
$('#success > .alert-danger').html("<button type='button' class='close' data-dismiss='alert' aria-hidden='true'>&times;")
.append("</button>");
$('#success > .alert-danger').append($("<strong>").text("Sorry " + firstName + ", it seems that my mail server is not responding. Please try again later!"));
$('#success > .alert-danger').append('</div>');
//clear all fields
$('#contactForm').trigger("reset");
},
complete: function() {
setTimeout(function() {
$this.prop("disabled", false); // Re-enable submit button when AJAX call is complete
}, 1000);
}
});
},
filter: function() {
return $(this).is(":visible");
},
});
$("a[data-toggle=\"tab\"]").click(function(e) {
e.preventDefault();
$(this).tab("show");
});
});
/*When clicking on Full hide fail/success boxes */
$('#name').focus(function() {
$('#success').html('');
});

View File

@ -1,75 +0,0 @@
(function($) {
"use strict"; // Start of use strict
// Smooth scrolling using jQuery easing
$('a.js-scroll-trigger[href*="#"]:not([href="#"])').click(function() {
if (location.pathname.replace(/^\//, '') == this.pathname.replace(/^\//, '') && location.hostname == this.hostname) {
var target = $(this.hash);
target = target.length ? target : $('[name=' + this.hash.slice(1) + ']');
if (target.length) {
$('html, body').animate({
scrollTop: (target.offset().top - 70)
}, 1000, "easeInOutExpo");
return false;
}
}
});
// Scroll to top button appear
$(document).scroll(function() {
var scrollDistance = $(this).scrollTop();
if (scrollDistance > 100) {
$('.scroll-to-top').fadeIn();
} else {
$('.scroll-to-top').fadeOut();
}
});
// Closes responsive menu when a scroll trigger link is clicked
$('.js-scroll-trigger').click(function() {
$('.navbar-collapse').collapse('hide');
});
// Activate scrollspy to add active class to navbar items on scroll
$('body').scrollspy({
target: '#mainNav',
offset: 80
});
// Collapse Navbar
var navbarCollapse = function() {
if ($("#mainNav").offset().top > 100) {
$("#mainNav").addClass("navbar-shrink");
} else {
$("#mainNav").removeClass("navbar-shrink");
}
};
// Collapse now if page is not at top
navbarCollapse();
// Collapse the navbar when page is scrolled
$(window).scroll(navbarCollapse);
// Modal popup$(function () {
$('.portfolio-item').magnificPopup({
type: 'inline',
preloader: false,
focus: '#username',
modal: true
});
$(document).on('click', '.portfolio-modal-dismiss', function(e) {
e.preventDefault();
$.magnificPopup.close();
});
// Floating label headings for the contact form
$(function() {
$("body").on("input propertychange", ".floating-label-form-group", function(e) {
$(this).toggleClass("floating-label-form-group-with-value", !!$(e.target).val());
}).on("focus", ".floating-label-form-group", function() {
$(this).addClass("floating-label-form-group-with-focus");
}).on("blur", ".floating-label-form-group", function() {
$(this).removeClass("floating-label-form-group-with-focus");
});
});
})(jQuery); // End of use strict

View File

@ -1,7 +0,0 @@
/*!
* Start Bootstrap - Freelancer v5.0.2 (https://startbootstrap.com/template-overviews/freelancer)
* Copyright 2013-2019 Start Bootstrap
* Licensed under MIT (https://github.com/BlackrockDigital/startbootstrap-freelancer/blob/master/LICENSE)
*/
!function(t){"use strict";t('a.js-scroll-trigger[href*="#"]:not([href="#"])').click(function(){if(location.pathname.replace(/^\//,"")==this.pathname.replace(/^\//,"")&&location.hostname==this.hostname){var o=t(this.hash);if((o=o.length?o:t("[name="+this.hash.slice(1)+"]")).length)return t("html, body").animate({scrollTop:o.offset().top-70},1e3,"easeInOutExpo"),!1}}),t(document).scroll(function(){100<t(this).scrollTop()?t(".scroll-to-top").fadeIn():t(".scroll-to-top").fadeOut()}),t(".js-scroll-trigger").click(function(){t(".navbar-collapse").collapse("hide")}),t("body").scrollspy({target:"#mainNav",offset:80});var o=function(){100<t("#mainNav").offset().top?t("#mainNav").addClass("navbar-shrink"):t("#mainNav").removeClass("navbar-shrink")};o(),t(window).scroll(o),t(".portfolio-item").magnificPopup({type:"inline",preloader:!1,focus:"#username",modal:!0}),t(document).on("click",".portfolio-modal-dismiss",function(o){o.preventDefault(),t.magnificPopup.close()}),t(function(){t("body").on("input propertychange",".floating-label-form-group",function(o){t(this).toggleClass("floating-label-form-group-with-value",!!t(o.target).val())}).on("focus",".floating-label-form-group",function(){t(this).addClass("floating-label-form-group-with-focus")}).on("blur",".floating-label-form-group",function(){t(this).removeClass("floating-label-form-group-with-focus")})})}(jQuery);

View File

@ -1,912 +0,0 @@
/* jqBootstrapValidation
* A plugin for automating validation on Twitter Bootstrap formatted forms.
*
* v1.3.6
*
* License: MIT <http://opensource.org/licenses/mit-license.php> - see LICENSE file
*
* http://ReactiveRaven.github.com/jqBootstrapValidation/
*/
(function( $ ){
var createdElements = [];
var defaults = {
options: {
prependExistingHelpBlock: false,
sniffHtml: true, // sniff for 'required', 'maxlength', etc
preventSubmit: true, // stop the form submit event from firing if validation fails
submitError: false, // function called if there is an error when trying to submit
submitSuccess: false, // function called just before a successful submit event is sent to the server
semanticallyStrict: false, // set to true to tidy up generated HTML output
autoAdd: {
helpBlocks: true
},
filter: function () {
// return $(this).is(":visible"); // only validate elements you can see
return true; // validate everything
}
},
methods: {
init : function( options ) {
var settings = $.extend(true, {}, defaults);
settings.options = $.extend(true, settings.options, options);
var $siblingElements = this;
var uniqueForms = $.unique(
$siblingElements.map( function () {
return $(this).parents("form")[0];
}).toArray()
);
$(uniqueForms).bind("submit", function (e) {
var $form = $(this);
var warningsFound = 0;
var $inputs = $form.find("input,textarea,select").not("[type=submit],[type=image]").filter(settings.options.filter);
$inputs.trigger("submit.validation").trigger("validationLostFocus.validation");
$inputs.each(function (i, el) {
var $this = $(el),
$controlGroup = $this.parents(".control-group").first();
if (
$controlGroup.hasClass("warning")
) {
$controlGroup.removeClass("warning").addClass("error");
warningsFound++;
}
});
$inputs.trigger("validationLostFocus.validation");
if (warningsFound) {
if (settings.options.preventSubmit) {
e.preventDefault();
}
$form.addClass("error");
if ($.isFunction(settings.options.submitError)) {
settings.options.submitError($form, e, $inputs.jqBootstrapValidation("collectErrors", true));
}
} else {
$form.removeClass("error");
if ($.isFunction(settings.options.submitSuccess)) {
settings.options.submitSuccess($form, e);
}
}
});
return this.each(function(){
// Get references to everything we're interested in
var $this = $(this),
$controlGroup = $this.parents(".control-group").first(),
$helpBlock = $controlGroup.find(".help-block").first(),
$form = $this.parents("form").first(),
validatorNames = [];
// create message container if not exists
if (!$helpBlock.length && settings.options.autoAdd && settings.options.autoAdd.helpBlocks) {
$helpBlock = $('<div class="help-block" />');
$controlGroup.find('.controls').append($helpBlock);
createdElements.push($helpBlock[0]);
}
// =============================================================
// SNIFF HTML FOR VALIDATORS
// =============================================================
// *snort sniff snuffle*
if (settings.options.sniffHtml) {
var message = "";
// ---------------------------------------------------------
// PATTERN
// ---------------------------------------------------------
if ($this.attr("pattern") !== undefined) {
message = "Not in the expected format<!-- data-validation-pattern-message to override -->";
if ($this.data("validationPatternMessage")) {
message = $this.data("validationPatternMessage");
}
$this.data("validationPatternMessage", message);
$this.data("validationPatternRegex", $this.attr("pattern"));
}
// ---------------------------------------------------------
// MAX
// ---------------------------------------------------------
if ($this.attr("max") !== undefined || $this.attr("aria-valuemax") !== undefined) {
var max = ($this.attr("max") !== undefined ? $this.attr("max") : $this.attr("aria-valuemax"));
message = "Too high: Maximum of '" + max + "'<!-- data-validation-max-message to override -->";
if ($this.data("validationMaxMessage")) {
message = $this.data("validationMaxMessage");
}
$this.data("validationMaxMessage", message);
$this.data("validationMaxMax", max);
}
// ---------------------------------------------------------
// MIN
// ---------------------------------------------------------
if ($this.attr("min") !== undefined || $this.attr("aria-valuemin") !== undefined) {
var min = ($this.attr("min") !== undefined ? $this.attr("min") : $this.attr("aria-valuemin"));
message = "Too low: Minimum of '" + min + "'<!-- data-validation-min-message to override -->";
if ($this.data("validationMinMessage")) {
message = $this.data("validationMinMessage");
}
$this.data("validationMinMessage", message);
$this.data("validationMinMin", min);
}
// ---------------------------------------------------------
// MAXLENGTH
// ---------------------------------------------------------
if ($this.attr("maxlength") !== undefined) {
message = "Too long: Maximum of '" + $this.attr("maxlength") + "' characters<!-- data-validation-maxlength-message to override -->";
if ($this.data("validationMaxlengthMessage")) {
message = $this.data("validationMaxlengthMessage");
}
$this.data("validationMaxlengthMessage", message);
$this.data("validationMaxlengthMaxlength", $this.attr("maxlength"));
}
// ---------------------------------------------------------
// MINLENGTH
// ---------------------------------------------------------
if ($this.attr("minlength") !== undefined) {
message = "Too short: Minimum of '" + $this.attr("minlength") + "' characters<!-- data-validation-minlength-message to override -->";
if ($this.data("validationMinlengthMessage")) {
message = $this.data("validationMinlengthMessage");
}
$this.data("validationMinlengthMessage", message);
$this.data("validationMinlengthMinlength", $this.attr("minlength"));
}
// ---------------------------------------------------------
// REQUIRED
// ---------------------------------------------------------
if ($this.attr("required") !== undefined || $this.attr("aria-required") !== undefined) {
message = settings.builtInValidators.required.message;
if ($this.data("validationRequiredMessage")) {
message = $this.data("validationRequiredMessage");
}
$this.data("validationRequiredMessage", message);
}
// ---------------------------------------------------------
// NUMBER
// ---------------------------------------------------------
if ($this.attr("type") !== undefined && $this.attr("type").toLowerCase() === "number") {
message = settings.builtInValidators.number.message;
if ($this.data("validationNumberMessage")) {
message = $this.data("validationNumberMessage");
}
$this.data("validationNumberMessage", message);
}
// ---------------------------------------------------------
// EMAIL
// ---------------------------------------------------------
if ($this.attr("type") !== undefined && $this.attr("type").toLowerCase() === "email") {
message = "Not a valid email address<!-- data-validator-validemail-message to override -->";
if ($this.data("validationValidemailMessage")) {
message = $this.data("validationValidemailMessage");
} else if ($this.data("validationEmailMessage")) {
message = $this.data("validationEmailMessage");
}
$this.data("validationValidemailMessage", message);
}
// ---------------------------------------------------------
// MINCHECKED
// ---------------------------------------------------------
if ($this.attr("minchecked") !== undefined) {
message = "Not enough options checked; Minimum of '" + $this.attr("minchecked") + "' required<!-- data-validation-minchecked-message to override -->";
if ($this.data("validationMincheckedMessage")) {
message = $this.data("validationMincheckedMessage");
}
$this.data("validationMincheckedMessage", message);
$this.data("validationMincheckedMinchecked", $this.attr("minchecked"));
}
// ---------------------------------------------------------
// MAXCHECKED
// ---------------------------------------------------------
if ($this.attr("maxchecked") !== undefined) {
message = "Too many options checked; Maximum of '" + $this.attr("maxchecked") + "' required<!-- data-validation-maxchecked-message to override -->";
if ($this.data("validationMaxcheckedMessage")) {
message = $this.data("validationMaxcheckedMessage");
}
$this.data("validationMaxcheckedMessage", message);
$this.data("validationMaxcheckedMaxchecked", $this.attr("maxchecked"));
}
}
// =============================================================
// COLLECT VALIDATOR NAMES
// =============================================================
// Get named validators
if ($this.data("validation") !== undefined) {
validatorNames = $this.data("validation").split(",");
}
// Get extra ones defined on the element's data attributes
$.each($this.data(), function (i, el) {
var parts = i.replace(/([A-Z])/g, ",$1").split(",");
if (parts[0] === "validation" && parts[1]) {
validatorNames.push(parts[1]);
}
});
// =============================================================
// NORMALISE VALIDATOR NAMES
// =============================================================
var validatorNamesToInspect = validatorNames;
var newValidatorNamesToInspect = [];
do // repeatedly expand 'shortcut' validators into their real validators
{
// Uppercase only the first letter of each name
$.each(validatorNames, function (i, el) {
validatorNames[i] = formatValidatorName(el);
});
// Remove duplicate validator names
validatorNames = $.unique(validatorNames);
// Pull out the new validator names from each shortcut
newValidatorNamesToInspect = [];
$.each(validatorNamesToInspect, function(i, el) {
if ($this.data("validation" + el + "Shortcut") !== undefined) {
// Are these custom validators?
// Pull them out!
$.each($this.data("validation" + el + "Shortcut").split(","), function(i2, el2) {
newValidatorNamesToInspect.push(el2);
});
} else if (settings.builtInValidators[el.toLowerCase()]) {
// Is this a recognised built-in?
// Pull it out!
var validator = settings.builtInValidators[el.toLowerCase()];
if (validator.type.toLowerCase() === "shortcut") {
$.each(validator.shortcut.split(","), function (i, el) {
el = formatValidatorName(el);
newValidatorNamesToInspect.push(el);
validatorNames.push(el);
});
}
}
});
validatorNamesToInspect = newValidatorNamesToInspect;
} while (validatorNamesToInspect.length > 0)
// =============================================================
// SET UP VALIDATOR ARRAYS
// =============================================================
var validators = {};
$.each(validatorNames, function (i, el) {
// Set up the 'override' message
var message = $this.data("validation" + el + "Message");
var hasOverrideMessage = (message !== undefined);
var foundValidator = false;
message =
(
message
? message
: "'" + el + "' validation failed <!-- Add attribute 'data-validation-" + el.toLowerCase() + "-message' to input to change this message -->"
)
;
$.each(
settings.validatorTypes,
function (validatorType, validatorTemplate) {
if (validators[validatorType] === undefined) {
validators[validatorType] = [];
}
if (!foundValidator && $this.data("validation" + el + formatValidatorName(validatorTemplate.name)) !== undefined) {
validators[validatorType].push(
$.extend(
true,
{
name: formatValidatorName(validatorTemplate.name),
message: message
},
validatorTemplate.init($this, el)
)
);
foundValidator = true;
}
}
);
if (!foundValidator && settings.builtInValidators[el.toLowerCase()]) {
var validator = $.extend(true, {}, settings.builtInValidators[el.toLowerCase()]);
if (hasOverrideMessage) {
validator.message = message;
}
var validatorType = validator.type.toLowerCase();
if (validatorType === "shortcut") {
foundValidator = true;
} else {
$.each(
settings.validatorTypes,
function (validatorTemplateType, validatorTemplate) {
if (validators[validatorTemplateType] === undefined) {
validators[validatorTemplateType] = [];
}
if (!foundValidator && validatorType === validatorTemplateType.toLowerCase()) {
$this.data("validation" + el + formatValidatorName(validatorTemplate.name), validator[validatorTemplate.name.toLowerCase()]);
validators[validatorType].push(
$.extend(
validator,
validatorTemplate.init($this, el)
)
);
foundValidator = true;
}
}
);
}
}
if (! foundValidator) {
$.error("Cannot find validation info for '" + el + "'");
}
});
// =============================================================
// STORE FALLBACK VALUES
// =============================================================
$helpBlock.data(
"original-contents",
(
$helpBlock.data("original-contents")
? $helpBlock.data("original-contents")
: $helpBlock.html()
)
);
$helpBlock.data(
"original-role",
(
$helpBlock.data("original-role")
? $helpBlock.data("original-role")
: $helpBlock.attr("role")
)
);
$controlGroup.data(
"original-classes",
(
$controlGroup.data("original-clases")
? $controlGroup.data("original-classes")
: $controlGroup.attr("class")
)
);
$this.data(
"original-aria-invalid",
(
$this.data("original-aria-invalid")
? $this.data("original-aria-invalid")
: $this.attr("aria-invalid")
)
);
// =============================================================
// VALIDATION
// =============================================================
$this.bind(
"validation.validation",
function (event, params) {
var value = getValue($this);
// Get a list of the errors to apply
var errorsFound = [];
$.each(validators, function (validatorType, validatorTypeArray) {
if (value || value.length || (params && params.includeEmpty) || (!!settings.validatorTypes[validatorType].blockSubmit && params && !!params.submitting)) {
$.each(validatorTypeArray, function (i, validator) {
if (settings.validatorTypes[validatorType].validate($this, value, validator)) {
errorsFound.push(validator.message);
}
});
}
});
return errorsFound;
}
);
$this.bind(
"getValidators.validation",
function () {
return validators;
}
);
// =============================================================
// WATCH FOR CHANGES
// =============================================================
$this.bind(
"submit.validation",
function () {
return $this.triggerHandler("change.validation", {submitting: true});
}
);
$this.bind(
[
"keyup",
"focus",
"blur",
"click",
"keydown",
"keypress",
"change"
].join(".validation ") + ".validation",
function (e, params) {
var value = getValue($this);
var errorsFound = [];
$controlGroup.find("input,textarea,select").each(function (i, el) {
var oldCount = errorsFound.length;
$.each($(el).triggerHandler("validation.validation", params), function (j, message) {
errorsFound.push(message);
});
if (errorsFound.length > oldCount) {
$(el).attr("aria-invalid", "true");
} else {
var original = $this.data("original-aria-invalid");
$(el).attr("aria-invalid", (original !== undefined ? original : false));
}
});
$form.find("input,select,textarea").not($this).not("[name=\"" + $this.attr("name") + "\"]").trigger("validationLostFocus.validation");
errorsFound = $.unique(errorsFound.sort());
// Were there any errors?
if (errorsFound.length) {
// Better flag it up as a warning.
$controlGroup.removeClass("success error").addClass("warning");
// How many errors did we find?
if (settings.options.semanticallyStrict && errorsFound.length === 1) {
// Only one? Being strict? Just output it.
$helpBlock.html(errorsFound[0] +
( settings.options.prependExistingHelpBlock ? $helpBlock.data("original-contents") : "" ));
} else {
// Multiple? Being sloppy? Glue them together into an UL.
$helpBlock.html("<ul role=\"alert\"><li>" + errorsFound.join("</li><li>") + "</li></ul>" +
( settings.options.prependExistingHelpBlock ? $helpBlock.data("original-contents") : "" ));
}
} else {
$controlGroup.removeClass("warning error success");
if (value.length > 0) {
$controlGroup.addClass("success");
}
$helpBlock.html($helpBlock.data("original-contents"));
}
if (e.type === "blur") {
$controlGroup.removeClass("success");
}
}
);
$this.bind("validationLostFocus.validation", function () {
$controlGroup.removeClass("success");
});
});
},
destroy : function( ) {
return this.each(
function() {
var
$this = $(this),
$controlGroup = $this.parents(".control-group").first(),
$helpBlock = $controlGroup.find(".help-block").first();
// remove our events
$this.unbind('.validation'); // events are namespaced.
// reset help text
$helpBlock.html($helpBlock.data("original-contents"));
// reset classes
$controlGroup.attr("class", $controlGroup.data("original-classes"));
// reset aria
$this.attr("aria-invalid", $this.data("original-aria-invalid"));
// reset role
$helpBlock.attr("role", $this.data("original-role"));
// remove all elements we created
if (createdElements.indexOf($helpBlock[0]) > -1) {
$helpBlock.remove();
}
}
);
},
collectErrors : function(includeEmpty) {
var errorMessages = {};
this.each(function (i, el) {
var $el = $(el);
var name = $el.attr("name");
var errors = $el.triggerHandler("validation.validation", {includeEmpty: true});
errorMessages[name] = $.extend(true, errors, errorMessages[name]);
});
$.each(errorMessages, function (i, el) {
if (el.length === 0) {
delete errorMessages[i];
}
});
return errorMessages;
},
hasErrors: function() {
var errorMessages = [];
this.each(function (i, el) {
errorMessages = errorMessages.concat(
$(el).triggerHandler("getValidators.validation") ? $(el).triggerHandler("validation.validation", {submitting: true}) : []
);
});
return (errorMessages.length > 0);
},
override : function (newDefaults) {
defaults = $.extend(true, defaults, newDefaults);
}
},
validatorTypes: {
callback: {
name: "callback",
init: function ($this, name) {
return {
validatorName: name,
callback: $this.data("validation" + name + "Callback"),
lastValue: $this.val(),
lastValid: true,
lastFinished: true
};
},
validate: function ($this, value, validator) {
if (validator.lastValue === value && validator.lastFinished) {
return !validator.lastValid;
}
if (validator.lastFinished === true)
{
validator.lastValue = value;
validator.lastValid = true;
validator.lastFinished = false;
var rrjqbvValidator = validator;
var rrjqbvThis = $this;
executeFunctionByName(
validator.callback,
window,
$this,
value,
function (data) {
if (rrjqbvValidator.lastValue === data.value) {
rrjqbvValidator.lastValid = data.valid;
if (data.message) {
rrjqbvValidator.message = data.message;
}
rrjqbvValidator.lastFinished = true;
rrjqbvThis.data("validation" + rrjqbvValidator.validatorName + "Message", rrjqbvValidator.message);
// Timeout is set to avoid problems with the events being considered 'already fired'
setTimeout(function () {
rrjqbvThis.trigger("change.validation");
}, 1); // doesn't need a long timeout, just long enough for the event bubble to burst
}
}
);
}
return false;
}
},
ajax: {
name: "ajax",
init: function ($this, name) {
return {
validatorName: name,
url: $this.data("validation" + name + "Ajax"),
lastValue: $this.val(),
lastValid: true,
lastFinished: true
};
},
validate: function ($this, value, validator) {
if (""+validator.lastValue === ""+value && validator.lastFinished === true) {
return validator.lastValid === false;
}
if (validator.lastFinished === true)
{
validator.lastValue = value;
validator.lastValid = true;
validator.lastFinished = false;
$.ajax({
url: validator.url,
data: "value=" + value + "&field=" + $this.attr("name"),
dataType: "json",
success: function (data) {
if (""+validator.lastValue === ""+data.value) {
validator.lastValid = !!(data.valid);
if (data.message) {
validator.message = data.message;
}
validator.lastFinished = true;
$this.data("validation" + validator.validatorName + "Message", validator.message);
// Timeout is set to avoid problems with the events being considered 'already fired'
setTimeout(function () {
$this.trigger("change.validation");
}, 1); // doesn't need a long timeout, just long enough for the event bubble to burst
}
},
failure: function () {
validator.lastValid = true;
validator.message = "ajax call failed";
validator.lastFinished = true;
$this.data("validation" + validator.validatorName + "Message", validator.message);
// Timeout is set to avoid problems with the events being considered 'already fired'
setTimeout(function () {
$this.trigger("change.validation");
}, 1); // doesn't need a long timeout, just long enough for the event bubble to burst
}
});
}
return false;
}
},
regex: {
name: "regex",
init: function ($this, name) {
return {regex: regexFromString($this.data("validation" + name + "Regex"))};
},
validate: function ($this, value, validator) {
return (!validator.regex.test(value) && ! validator.negative)
|| (validator.regex.test(value) && validator.negative);
}
},
required: {
name: "required",
init: function ($this, name) {
return {};
},
validate: function ($this, value, validator) {
return !!(value.length === 0 && ! validator.negative)
|| !!(value.length > 0 && validator.negative);
},
blockSubmit: true
},
match: {
name: "match",
init: function ($this, name) {
var element = $this.parents("form").first().find("[name=\"" + $this.data("validation" + name + "Match") + "\"]").first();
element.bind("validation.validation", function () {
$this.trigger("change.validation", {submitting: true});
});
return {"element": element};
},
validate: function ($this, value, validator) {
return (value !== validator.element.val() && ! validator.negative)
|| (value === validator.element.val() && validator.negative);
},
blockSubmit: true
},
max: {
name: "max",
init: function ($this, name) {
return {max: $this.data("validation" + name + "Max")};
},
validate: function ($this, value, validator) {
return (parseFloat(value, 10) > parseFloat(validator.max, 10) && ! validator.negative)
|| (parseFloat(value, 10) <= parseFloat(validator.max, 10) && validator.negative);
}
},
min: {
name: "min",
init: function ($this, name) {
return {min: $this.data("validation" + name + "Min")};
},
validate: function ($this, value, validator) {
return (parseFloat(value) < parseFloat(validator.min) && ! validator.negative)
|| (parseFloat(value) >= parseFloat(validator.min) && validator.negative);
}
},
maxlength: {
name: "maxlength",
init: function ($this, name) {
return {maxlength: $this.data("validation" + name + "Maxlength")};
},
validate: function ($this, value, validator) {
return ((value.length > validator.maxlength) && ! validator.negative)
|| ((value.length <= validator.maxlength) && validator.negative);
}
},
minlength: {
name: "minlength",
init: function ($this, name) {
return {minlength: $this.data("validation" + name + "Minlength")};
},
validate: function ($this, value, validator) {
return ((value.length < validator.minlength) && ! validator.negative)
|| ((value.length >= validator.minlength) && validator.negative);
}
},
maxchecked: {
name: "maxchecked",
init: function ($this, name) {
var elements = $this.parents("form").first().find("[name=\"" + $this.attr("name") + "\"]");
elements.bind("click.validation", function () {
$this.trigger("change.validation", {includeEmpty: true});
});
return {maxchecked: $this.data("validation" + name + "Maxchecked"), elements: elements};
},
validate: function ($this, value, validator) {
return (validator.elements.filter(":checked").length > validator.maxchecked && ! validator.negative)
|| (validator.elements.filter(":checked").length <= validator.maxchecked && validator.negative);
},
blockSubmit: true
},
minchecked: {
name: "minchecked",
init: function ($this, name) {
var elements = $this.parents("form").first().find("[name=\"" + $this.attr("name") + "\"]");
elements.bind("click.validation", function () {
$this.trigger("change.validation", {includeEmpty: true});
});
return {minchecked: $this.data("validation" + name + "Minchecked"), elements: elements};
},
validate: function ($this, value, validator) {
return (validator.elements.filter(":checked").length < validator.minchecked && ! validator.negative)
|| (validator.elements.filter(":checked").length >= validator.minchecked && validator.negative);
},
blockSubmit: true
}
},
builtInValidators: {
email: {
name: "Email",
type: "shortcut",
shortcut: "validemail"
},
validemail: {
name: "Validemail",
type: "regex",
regex: "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\\.[A-Za-z]{2,4}",
message: "Not a valid email address<!-- data-validator-validemail-message to override -->"
},
passwordagain: {
name: "Passwordagain",
type: "match",
match: "password",
message: "Does not match the given password<!-- data-validator-paswordagain-message to override -->"
},
positive: {
name: "Positive",
type: "shortcut",
shortcut: "number,positivenumber"
},
negative: {
name: "Negative",
type: "shortcut",
shortcut: "number,negativenumber"
},
number: {
name: "Number",
type: "regex",
regex: "([+-]?\\\d+(\\\.\\\d*)?([eE][+-]?[0-9]+)?)?",
message: "Must be a number<!-- data-validator-number-message to override -->"
},
integer: {
name: "Integer",
type: "regex",
regex: "[+-]?\\\d+",
message: "No decimal places allowed<!-- data-validator-integer-message to override -->"
},
positivenumber: {
name: "Positivenumber",
type: "min",
min: 0,
message: "Must be a positive number<!-- data-validator-positivenumber-message to override -->"
},
negativenumber: {
name: "Negativenumber",
type: "max",
max: 0,
message: "Must be a negative number<!-- data-validator-negativenumber-message to override -->"
},
required: {
name: "Required",
type: "required",
message: "This is required<!-- data-validator-required-message to override -->"
},
checkone: {
name: "Checkone",
type: "minchecked",
minchecked: 1,
message: "Check at least one option<!-- data-validation-checkone-message to override -->"
}
}
};
var formatValidatorName = function (name) {
return name
.toLowerCase()
.replace(
/(^|\s)([a-z])/g ,
function(m,p1,p2) {
return p1+p2.toUpperCase();
}
)
;
};
var getValue = function ($this) {
// Extract the value we're talking about
var value = $this.val();
var type = $this.attr("type");
if (type === "checkbox") {
value = ($this.is(":checked") ? value : "");
}
if (type === "radio") {
value = ($('input[name="' + $this.attr("name") + '"]:checked').length > 0 ? value : "");
}
return value;
};
function regexFromString(inputstring) {
return new RegExp("^" + inputstring + "$");
}
/**
* Thanks to Jason Bunting via StackOverflow.com
*
* http://stackoverflow.com/questions/359788/how-to-execute-a-javascript-function-when-i-have-its-name-as-a-string#answer-359910
* Short link: http://tinyurl.com/executeFunctionByName
**/
function executeFunctionByName(functionName, context /*, args*/) {
var args = Array.prototype.slice.call(arguments).splice(2);
var namespaces = functionName.split(".");
var func = namespaces.pop();
for(var i = 0; i < namespaces.length; i++) {
context = context[namespaces[i]];
}
return context[func].apply(this, args);
}
$.fn.jqBootstrapValidation = function( method ) {
if ( defaults.methods[method] ) {
return defaults.methods[method].apply( this, Array.prototype.slice.call( arguments, 1 ));
} else if ( typeof method === 'object' || ! method ) {
return defaults.methods.init.apply( this, arguments );
} else {
$.error( 'Method ' + method + ' does not exist on jQuery.jqBootstrapValidation' );
return null;
}
};
$.jqBootstrapValidation = function (options) {
$(":input").not("[type=image],[type=submit]").jqBootstrapValidation.apply(this,arguments);
};
})( jQuery );

View File

@ -1,22 +0,0 @@
<?php
// Check for empty fields
if(empty($_POST['name']) || empty($_POST['email']) || empty($_POST['phone']) || empty($_POST['message']) || !filter_var($_POST['email'], FILTER_VALIDATE_EMAIL)) {
http_response_code(500);
exit();
}
$name = strip_tags(htmlspecialchars($_POST['name']));
$email = strip_tags(htmlspecialchars($_POST['email']));
$phone = strip_tags(htmlspecialchars($_POST['phone']));
$message = strip_tags(htmlspecialchars($_POST['message']));
// Create the email and send the message
$to = "yourname@yourdomain.com"; // Add your email address inbetween the "" replacing yourname@yourdomain.com - This is where the form will send a message to.
$subject = "Website Contact Form: $name";
$body = "You have received a new message from your website contact form.\n\n"."Here are the details:\n\nName: $name\n\nEmail: $email\n\nPhone: $phone\n\nMessage:\n$message";
$header = "From: noreply@yourdomain.com\n"; // This is the email address the generated message will be from. We recommend using something like noreply@yourdomain.com.
$header .= "Reply-To: $email";
if(!mail($to, $subject, $body, $header))
http_response_code(500);
?>

6595
docs/package-lock.json generated

File diff suppressed because it is too large Load Diff

View File

@ -1,47 +0,0 @@
{
"title": "Freelancer",
"name": "startbootstrap-freelancer",
"version": "5.0.2",
"description": "A freelancer portfolio HTML theme for Bootstrap.",
"keywords": [
"css",
"sass",
"html",
"responsive",
"theme",
"template"
],
"homepage": "https://startbootstrap.com/template-overviews/freelancer",
"bugs": {
"url": "https://github.com/BlackrockDigital/startbootstrap-freelancer/issues",
"email": "feedback@startbootstrap.com"
},
"license": "MIT",
"author": "Start Bootstrap",
"contributors": [
"David Miller (http://davidmiller.io/)"
],
"repository": {
"type": "git",
"url": "https://github.com/BlackrockDigital/startbootstrap-freelancer.git"
},
"dependencies": {
"@fortawesome/fontawesome-free": "5.7.0",
"bootstrap": "4.2.1",
"jquery": "3.3.1",
"jquery.easing": "^1.4.1",
"magnific-popup": "^1.1.0"
},
"devDependencies": {
"browser-sync": "2.26.3",
"gulp": "4.0.0",
"gulp-autoprefixer": "6.0.0",
"gulp-clean-css": "4.0.0",
"gulp-filter": "5.1.0",
"gulp-header": "2.0.7",
"gulp-plumber": "^1.2.1",
"gulp-rename": "1.4.0",
"gulp-sass": "4.0.2",
"gulp-uglify": "3.0.1"
}
}

View File

@ -1,51 +0,0 @@
// Bootstrap overrides for this template
a {
color: $primary;
&:focus,
&:hover,
&:active {
color: darken($primary, 10%);
}
}
.btn {
border-width: 2px;
}
.bg-primary {
background-color: $primary !important;
}
.bg-secondary {
background-color: $secondary !important;
}
.text-primary {
color: $primary !important;
}
.text-secondary {
color: $secondary !important;
}
.btn-primary {
background-color: $primary;
border-color: $primary;
&:hover,
&:focus,
&:active {
background-color: darken($primary, 10%);
border-color: darken($primary, 10%);
}
}
.btn-secondary {
background-color: $secondary;
border-color: $secondary;
&:hover,
&:focus,
&:active {
background-color: darken($secondary, 10%);
border-color: darken($secondary, 10%);
}
}

View File

@ -1,54 +0,0 @@
// Styling for the contact section
.floating-label-form-group {
position: relative;
border-bottom: 1px solid $gray-200;
input,
textarea {
font-size: 1.5em;
position: relative;
z-index: 1;
padding-right: 0;
padding-left: 0;
resize: none;
border: none;
border-radius: 0;
background: none;
box-shadow: none !important;
}
label {
font-size: 0.85em;
line-height: 1.764705882em;
position: relative;
z-index: 0;
top: 2em;
display: block;
margin: 0;
-webkit-transition: top 0.3s ease, opacity 0.3s ease;
-moz-transition: top 0.3s ease, opacity 0.3s ease;
-ms-transition: top 0.3s ease, opacity 0.3s ease;
transition: top 0.3s ease, opacity 0.3s ease;
vertical-align: middle;
vertical-align: baseline;
opacity: 0;
}
&:not(:first-child) {
padding-left: 14px;
border-left: 1px solid $gray-200;
}
}
.floating-label-form-group-with-value {
label {
top: 0;
opacity: 1;
}
}
.floating-label-form-group-with-focus {
label {
color: $primary;
}
}
form .row:first-child .floating-label-form-group {
border-top: 1px solid $gray-200;
}

View File

@ -1,10 +0,0 @@
.footer {
padding-top: 5rem;
padding-bottom: 5rem;
background-color: $secondary;
color: $white;
}
.copyright {
background-color: darken($secondary, 10%);
}

View File

@ -1,98 +0,0 @@
// Typography
body {
@include body-font;
}
h1,
h2,
h3,
h4,
h5,
h6 {
@include heading-font;
}
// Custom Horizontal Rule with Star Icon
hr.star-light,
hr.star-dark {
max-width: 15rem;
padding: 0;
text-align: center;
border: none;
border-top: solid 0.25rem;
margin-top: 2.5rem;
margin-bottom: 2.5rem;
margin-left: auto;
margin-right: auto;
}
hr.star-light:after,
hr.star-dark:after {
position: relative;
top: -.8em;
display: inline-block;
padding: 0 0.25em;
content: '\f005';
font-family: "Font Awesome 5 Free";
font-weight: 900;
font-size: 2em;
}
hr.star-light {
border-color: $white;
}
hr.star-light:after {
color: $white;
background-color: $primary;
}
hr.star-dark {
border-color: $secondary;
}
hr.star-dark:after {
color: $secondary;
background-color: white;
}
// Section Padding Settings
section {
padding: 6rem 0;
h2 {
font-size: 2.25rem;
line-height: 2rem;
}
@media (min-width: 992px) {
h2 {
font-size: 3rem;
line-height: 2.5rem;
}
}
}
// Custom Button Size
.btn-xl {
padding: 1rem 1.75rem;
font-size: 1.25rem;
}
// Custom Rounded Social Button
.btn-social {
width: 3.25rem;
height: 3.25rem;
font-size: 1.25rem;
line-height: 2rem;
}
// Scroll to Top Button
.scroll-to-top {
z-index: 1042;
right: 1rem;
bottom: 1rem;
display: none;
a {
width: 3.5rem;
height: 3.5rem;
background-color: fade-out($gray-900, 0.5);
line-height: 3.1rem;
}
}

View File

@ -1,26 +0,0 @@
header.masthead {
padding-top: calc(6rem + 72px);
padding-bottom: 6rem;
h1 {
font-size: 3rem;
line-height: 3rem;
}
h2 {
font-size: 1.3rem;
@include body-font;
}
}
@media (min-width: 992px) {
header.masthead {
padding-top: calc(6rem + 106px);
padding-bottom: 6rem;
h1 {
font-size: 4.75em;
line-height: 4rem;
}
h2 {
font-size: 1.75em;
}
}
}

View File

@ -1,8 +0,0 @@
@mixin body-font() {
font-family: 'Lato';
}
@mixin heading-font() {
font-weight: 700;
font-family: 'Montserrat';
}

View File

@ -1,67 +0,0 @@
// Styling for the navbar
#mainNav {
padding-top: 1rem;
padding-bottom: 1rem;
@include heading-font;
.navbar-brand {
color: $white;
}
.navbar-nav {
margin-top: 1rem;
letter-spacing: 0.0625rem;
li.nav-item {
a.nav-link {
color: $white;
&:hover {
color: $primary;
}
&:active,
&:focus {
color: $white;
}
&.active {
color: $primary;
}
}
}
}
.navbar-toggler {
font-size: 80%;
padding: 0.8rem;
}
}
@media(min-width:992px) {
#mainNav {
padding-top: 1.5rem;
padding-bottom: 1.5rem;
-webkit-transition: padding-top 0.3s, padding-bottom 0.3s;
-moz-transition: padding-top 0.3s, padding-bottom 0.3s;
transition: padding-top 0.3s, padding-bottom 0.3s;
.navbar-brand {
font-size: 2em;
-webkit-transition: font-size 0.3s;
-moz-transition: font-size 0.3s;
transition: font-size 0.3s;
}
.navbar-nav {
margin-top: 0;
}
.navbar-nav > li.nav-item > a.nav-link.active {
color: $white;
background: $primary;
&:active,
&:focus,
&:hover {
color: $white;
background: $primary;
}
}
}
#mainNav.navbar-shrink {
padding-top: 0.5rem;
padding-bottom: 0.5rem;
.navbar-brand {
font-size: 1.5em;
}
}
}

View File

@ -1,63 +0,0 @@
// Styling for the portfolio section
.portfolio {
margin-bottom: -15px;
.portfolio-item {
position: relative;
display: block;
max-width: 25rem;
margin-bottom: 15px;
.portfolio-item-caption {
-webkit-transition: all ease 0.5s;
-moz-transition: all ease 0.5s;
transition: all ease 0.5s;
opacity: 0;
background-color: fade-out($primary, .1);
&:hover {
opacity: 1;
}
.portfolio-item-caption-content {
font-size: 1.5rem;
}
}
}
@media (min-width: 576px) {
margin-bottom: -30px;
.portfolio-item {
margin-bottom: 30px;
}
}
}
.portfolio-modal {
.portfolio-modal-dialog {
padding: 3rem 1rem;
min-height: calc(100vh - 2rem);
margin: 1rem calc(1rem - 8px);
position: relative;
z-index: 2;
-moz-box-shadow: 0 0 3rem 1rem fade-out(black, .5);
-webkit-box-shadow: 0 0 3rem 1rem fade-out(black, .5);
box-shadow: 0 0 3rem 1rem fade-out(black, .5);
.close-button {
position: absolute;
top: 2rem;
right: 2rem;
i {
line-height: 38px;
}
}
h2 {
font-size: 2rem;
}
}
@media(min-width: 768px) {
.portfolio-modal-dialog {
min-height: 100vh;
padding: 5rem;
margin: 3rem calc(3rem - 8px);
h2 {
font-size: 3rem;
}
}
}
}

View File

@ -1,16 +0,0 @@
// Variables
$white: #fff !default;
$gray-100: #f8f9fa !default;
$gray-200: #e9ecef !default;
$gray-300: #dee2e6 !default;
$gray-400: #ced4da !default;
$gray-500: #adb5bd !default;
$gray-600: #868e96 !default;
$gray-700: #495057 !default;
$gray-800: #343a40 !default;
$gray-900: #212529 !default;
$black: #000 !default;
$primary: #18BC9C !default;
$secondary: #2C3E50 !default;

View File

@ -1,9 +0,0 @@
@import "variables.scss";
@import "mixins.scss";
@import "global.scss";
@import "navbar.scss";
@import "masthead.scss";
@import "portfolio.scss";
@import "contact.scss";
@import "footer.scss";
@import "bootstrap-overrides.scss";

File diff suppressed because it is too large Load Diff

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load Diff

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load Diff

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

File diff suppressed because it is too large Load Diff

File diff suppressed because one or more lines are too long

File diff suppressed because one or more lines are too long

Binary file not shown.

File diff suppressed because it is too large Load Diff

Before

Width:  |  Height:  |  Size: 434 KiB

View File

@ -1,34 +0,0 @@
// Animated Icons
// --------------------------
.@{fa-css-prefix}-spin {
-webkit-animation: fa-spin 2s infinite linear;
animation: fa-spin 2s infinite linear;
}
.@{fa-css-prefix}-pulse {
-webkit-animation: fa-spin 1s infinite steps(8);
animation: fa-spin 1s infinite steps(8);
}
@-webkit-keyframes fa-spin {
0% {
-webkit-transform: rotate(0deg);
transform: rotate(0deg);
}
100% {
-webkit-transform: rotate(359deg);
transform: rotate(359deg);
}
}
@keyframes fa-spin {
0% {
-webkit-transform: rotate(0deg);
transform: rotate(0deg);
}
100% {
-webkit-transform: rotate(359deg);
transform: rotate(359deg);
}
}

Some files were not shown because too many files have changed in this diff Show More